Privacy policy

Last updated: 6 October 2026

SummaryWe collect only what we need to run the checks you ask for and to protect the items you choose to monitor. We never ask for or store your passwords to other services, PINs or OTP codes. We do not sell your personal data. Our public pages use Google Analytics to count visits and may show Google AdSense ads, which use cookies as described below.

This policy explains how Drofsecurity ("we", "us"), operated by Atechsole, handles information when you use drofsecurity.com and its related services.

1. Information we collect

• Account details: your name, email address, account type (personal or organization), organization name, chosen country and plan.
• Items you ask us to monitor: emails, phone numbers, domains, websites or devices that you add and confirm belong to you.
• Things you submit for checking: links, messages, phone numbers, payment details of a suspected scammer, website addresses and public GitHub repositories. We store results so you can see your history and so we can improve scam detection.
• Password checks: when you check a password, only the first five characters of its SHA-1 hash leave your browser (k-anonymity). We never see or store the password itself.
• Device agent data: if you run our optional Windows agent, it reports security settings (antivirus, firewall, update status, risky apps). It does not read your files.
• Payment records: the plan, amount and transaction reference you submit. We do not store card numbers.
• Technical data: IP address (used to guess your country and to prevent abuse), browser type, pages visited and timestamps.

2. How we use it

• To run the checks and scans you request and show you the results.
• To alert you when a monitored item appears in a new breach or your website's security changes.
• To manage your account, plan, referrals and support requests.
• To keep the service secure, enforce fair-use limits and prevent abuse.
• To understand which pages are useful and improve them (aggregated analytics).

3. Cookies and similar technologies

We use your browser's local storage to keep you signed in, remember your country choice and remember a referral code. These are essential to the service.

We also use third-party cookies from Google:

• Google Analytics measures visits, page views and traffic sources so we can see how many people use the site each day. Google's use of this data is described in How Google uses information from sites that use its services. You can opt out with the Google Analytics opt-out browser add-on.
• Google AdSense may show advertising on our pages. Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this and other websites. Google's use of advertising cookies enables it and its partners to serve ads based on your visits to our site and/or other sites on the internet. You may opt out of personalised advertising by visiting Google Ads Settings, or opt out of some third-party vendors' use of cookies for personalised advertising at www.aboutads.info.

Visitors in the European Economic Area, the United Kingdom and Switzerland are shown a consent message before analytics or advertising cookies are set, and can change their choice at any time.

4. Third-party services that process data

To answer your checks we send the minimum necessary data to reputable security services, such as Have I Been Pwned (breach and password lookups), Google Safe Browsing and VirusTotal (link reputation), OSV.dev (known vulnerabilities in software libraries), Shodan InternetDB (publicly exposed ports of a scanned host) and a country-lookup service for your IP address. Our servers are hosted by Render and our website by Hostinger. Payments are made directly to our bank or wallet account; the payment provider handles those details.

5. Sharing

We do not sell or rent your personal data. We share it only with the service providers above, when you choose to share a report publicly, or when the law requires it. If you use our complaint drafts, nothing is sent to any agency unless you submit it yourself.

6. How long we keep data

Account data is kept while your account is open. Check and scan history is kept for up to 24 months. When you delete your account we delete or anonymise your personal data within 30 days, except records we must keep for legal or accounting reasons.

7. Security

Data is encrypted in transit with HTTPS. Passwords for your Drofsecurity account are stored only as salted bcrypt hashes. Access to production data is limited to the staff who need it.

8. Your rights

You can access, correct, export or delete your data, and object to or restrict some processing. Depending on where you live (for example under the GDPR, the UK GDPR, or California's CCPA/CPRA), you may have additional rights, including the right to complain to your data-protection authority. To use any of these rights, email support@drofsecurity.com.

9. Children

Drofsecurity is not directed at children under 13, and we do not knowingly collect their personal data. Parents who believe a child has given us data can contact us to have it removed.

10. Changes

We will post any changes on this page and update the date above.

11. Contact

Questions about this policy: support@drofsecurity.com, or see our contact page.