Privacy Policy

• Account details such as your name, email address, password hash, verification state, and security preferences.
• Domain, DNS, nameserver, mailbox, monitor, notification, and service-configuration information.
• Billing, account-balance, deposit, transaction, and blockchain-payment metadata. We do not request your wallet private keys or seed phrase.
• Support tickets, contact-form messages, replies, and other communications you send to us.
• Domains, email addresses, IP addresses, URLs, files, or text you choose to submit to a tool.

• Public IP address, request time, requested route, response status, and security or rate-limit events.
• Browser and device information supplied through HTTP headers or exposed by your browser, such as user agent, language, screen characteristics, and feature support.
• Authentication cookies, session identifiers, local-storage preferences, and anti-abuse verification results.
• Operational logs needed to secure, troubleshoot, and maintain the Services.

Account services

We process domain searches and registrations, DNS changes, mailbox details, uptime monitor URLs and check results, MX jobs, alert destinations, subscriptions, referral codes and relationships, points activity, redemptions, and transaction records to provide the features you request.

Browser-only tools

Tools identified as running locally—such as the email extractor, HTML editor, image resizer, PDF merger, and PDF editor—read and transform their input in your browser. XFOXSUITE does not upload those files or pasted contents to its servers as part of that local processing. Your browser, operating system, extensions, and downloaded-file location remain outside our control.

Server-processed lookup tools

MX, DNS, SSL verification, domain-to-IP, IP-to-domain, ping, uptime, and IP geolocation features send the lookup value and necessary request metadata to our backend. Our backend may then query DNS resolvers, authoritative servers, the target host, or a third-party data provider.

When you open the What Is My IP page, the tool automatically attempts to detect your current public IP address and perform an IP-details lookup. If the lookup succeeds, the detected IP and returned enrichment data are stored as a public report and may be added to our sitemap.

The following information may be deliberately published on public pages and included in our XML sitemap:

• active domains registered through XFOXSUITE, registration date, expiration date when available, and status;
• normalized domains checked through the public MX checker, their MX records, provider classification, status, and check timestamps;
• domains checked through DNS Zone Lookup, the authoritative nameserver used, and returned A, CNAME, TXT, SPF, DKIM, and NS records;
• normalized domains checked through Domain to IP and their returned public IPv4 A and IPv6 AAAA records;
• domains checked through SSL Verification, the resolved public endpoint, certificate trust and validity status, issuer, subject, serial number, and public SAN identities;
• a visitor's automatically detected public IP address, or another public IPv4 or IPv6 address manually checked through the IP tool, together with approximate geolocation, network, ISP, ASN, proxy, and hosting information returned by data providers;
• hostnames from enabled uptime monitors and privacy-safe check timestamps, up/down outcomes, HTTP status codes, response times, and recent uptime percentage.

Public MX reports do not publish the mailbox portion before “@”. Public uptime reports do not publish account IDs, full URL paths, query strings, credentials, alert settings, or diagnostic error messages. Public IP reports are not linked in our database to the visitor or account that requested the lookup.

Search engines and other third parties may independently copy, cache, or index public pages. Their retention and removal processes are outside our direct control.

Because the self-detection lookup begins when the What Is My IP page loads, do not open or use that page if you do not want your detected public IP address processed and published in this way.

• Provide, bill, maintain, and improve the Services.
• Register domains, manage DNS and email, run requested checks, and deliver alerts and support.
• Authenticate users, prevent fraud and abuse, enforce limits, and protect accounts and infrastructure.
• Diagnose failures, measure reliability, and maintain transaction and activity records.
• Send service messages and, where you choose, marketing or product communications.
• Meet legal obligations, respond to lawful requests, and enforce our Terms.

Depending on your location, we process information because it is necessary to perform our contract with you, pursue legitimate interests such as security and service reliability, comply with legal obligations, protect vital or legal interests, or act on your consent. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing.

We do not sell your personal information. We disclose information only as reasonably necessary to:

• domain registrars, registries, DNS, hosting, and email providers that fulfill your requested services;
• infrastructure, database, notification, security, support, and payment providers operating on our behalf;
• DNS and network providers such as Cloudflare and Google Public DNS when resolving records;
• IP intelligence providers such as IP-API, IPWhois, and FreeIPAPI when an IP lookup requires enrichment;
• authorities, advisors, or counterparties where required by law, needed to protect rights or safety, or connected with a merger, financing, acquisition, or sale of assets.

Third parties process information under their own terms and privacy policies when acting independently. Relevant notices include the Google Public DNS privacy notice and IP-API privacy policy.

We use Cloudflare Turnstile on selected forms and public tools to distinguish legitimate visitors from automated abuse. Turnstile loads Cloudflare code and processes browser and interaction signals for security purposes. Cloudflare’s handling of those signals is described in its Turnstile Privacy Addendum.

We use cookies and similar browser storage for login sessions, security, account continuity, theme and interface preferences, cart contents, and locally saved tool settings such as custom MX labels. Some storage is essential for requested features. You can clear or block browser storage, but login and other features may stop working correctly.

• Completed authenticated MX jobs, submitted addresses, and results are scheduled for deletion after 30 days.
• Detailed uptime check history is scheduled for deletion after 30 days.
• Public MX, DNS zone, SSL verification, and IP reports, active-domain portal data, and uptime hostname reports may remain while needed to provide the public reporting and sitemap features.
• Account, domain, mailbox, support, security, and transaction records are retained for the service lifecycle and as reasonably needed for legal, accounting, fraud-prevention, backup, and dispute-resolution purposes.
• Browser-only file contents generally remain in the current page or browser memory until you clear, replace, download, refresh, or close them. Locally saved preferences remain until you clear browser storage.

We use reasonable administrative, technical, and organizational safeguards, including access controls, encrypted transport, password hashing, session controls, two-factor authentication options, rate limiting, and anti-abuse checks. No system, transmission, provider, or storage method can be guaranteed completely secure.

Depending on applicable law, you may have rights to request access, correction, deletion, restriction, objection, or portability; withdraw consent; or complain to a privacy regulator. You can also manage marketing preferences, sessions, two-factor authentication, monitor settings, and auto-renewal from available account controls.

We may need to verify your identity before completing a request. Certain data may be retained where legally required or needed for security, transactions, disputes, or the rights of others. Public search-engine caches must be addressed with the relevant search provider after our own source page is changed or removed.

XFOXSUITE and its providers may process information in countries other than your own. Where required, we use legally recognized safeguards for international transfers. Local privacy laws may differ from those in your jurisdiction.

The Services are not directed to children who cannot legally consent to the processing described here. Do not provide a child’s personal information without valid authorization. If you believe a child has submitted information improperly, contact us so we can review it.

We may update this Policy as the Services, providers, or legal requirements change. The updated date identifies the current version. We will provide additional notice of material changes when required by law.

Privacy questions and rights requests can be submitted through our contact page. Please do not send passwords, private keys, seed phrases, or sensitive document contents in a support request.