Privacy Policy
Effective 14 August 2026
Canny Pigeons ("we", "us") is a DMARC monitoring service at cannypigeons.com and app.cannypigeons.com. This policy explains what we collect, why, how long we keep it, and the controls you have. The short version: we collect the minimum needed to run the service, we don't sell data, and you can delete everything yourself, at any time, from Settings.
What we collect
- Account data. Your email address, an optional display name, your organisation's name, and the domains you add for monitoring.
- DMARC aggregate reports. When you point a domain's DMARC record at us, mailbox providers (Google, Microsoft, Yahoo, and others) email us XML reports about mail sent using that domain. These contain sending server IP addresses, message counts, SPF/DKIM authentication results, and sender domains. They do not contain message content, subject lines, or recipient addresses — that's inherent to the DMARC aggregate format, not a promise we could break by accident.
- Billing data. Payments are processed by Stripe. We never see or store your card number — we keep only a Stripe customer reference and which plan you're on.
- Usage analytics. How the site and app are used — pages viewed, features used, browser and device type. In the app this may be linked to your account; on this website it's visit statistics.
- Operational logs. Server-side telemetry (request outcomes, error events, processing metrics) used to keep the service healthy. Logs are for operations, not advertising.
- Free DMARC checker. Domains submitted to the checker appear in our operational logs and anonymous usage statistics. If you ask us to email you a report or watch a domain, we store your email address and that domain so we can send what you asked for — and nothing else. Every such email includes a one-click unsubscribe link that deletes the record entirely.
What we use it for
- Providing the service: parsing your reports, building your dashboards, publishing hosted DMARC records you ask us to publish, and emailing you sign-in links and service notices.
- Billing and account management.
- Understanding how the product is used, so we can improve it.
- Keeping the service secure and reliable (rate limiting, abuse prevention, debugging).
We don't sell personal data, we don't run third-party advertising or tracking, and we don't use your report data for anything except showing it to you.
Cookies and identifiers
On this marketing site, analytics is your choice. It runs when you arrive, setting first-party identifiers (cookies or browser storage) so repeat visits can be told apart from one-off ones, and people from bots. A banner on your first visit lets you say no:
- Decline — we stop measuring your visits and delete what our analytics had stored on your device. Nothing follows you, and nothing is kept for later.
- Accept — analytics carries on as described above.
The answer is kept on this site, and you can change it by clearing this site's cookies and storage, which brings the banner back.
In the app, cookies aren't optional. The signed-in product at app.cannypigeons.com needs first-party cookies and browser storage to work at all — to keep you signed in, and to measure how the product is used so we can fix and improve it. There's no version of the app that runs without them, so no banner asks: using the app means accepting them, and declining on this marketing site doesn't carry across. If that isn't acceptable to you, don't sign up — the public checkers stay usable either way.
We don't use advertising or cross-site tracking cookies anywhere. This marketing site loads fonts from Google Fonts, which means your browser sends Google a standard font request (including your IP address) when the page loads.
Who we share it with
Only the service providers that run the product, and only what they need:
- Stripe — payment processing and invoicing. We never see or store your card number.
- A cloud infrastructure provider — hosting, storage, and the mail routing that receives your DMARC reports.
- A transactional email provider — delivers sign-in links, invitations, and service notices.
- An analytics and log management service — visit and usage statistics, plus our operational telemetry.
- Cloudflare Turnstile — protects our free DMARC checker from automated abuse by verifying visitors invisibly. It processes limited device and network signals as described in Cloudflare's Turnstile Privacy Addendum.
We may disclose data if required by law. If Canny Pigeons is ever acquired, this policy continues to apply to data collected under it.
Where it lives
The service runs on our infrastructure provider's global network, so data may be processed outside the country you live in. Our providers are established processors with their own security and compliance programmes.
How long we keep it
- Parsed report data — per your plan's history window (30 days on Free, 6 months on Pro). Older data is deleted automatically every night.
- Raw report emails — kept briefly (about 30 days) so failed parses can be replayed, then deleted.
- Account data — for as long as you have an account.
- Operational logs — short retention, then aged out.
Your controls
- Access and correction — your profile, email address, and organisation are editable in Settings.
- Deletion — Settings → Danger zone → Delete account removes your user, your organisation, its domains, hosted DNS records, and all collected report data, immediately and irreversibly. Any active subscription is cancelled at the same time.
- Anything else — email support@cannypigeons.com and we'll help, including with rights you may have under laws like the GDPR (access, portability, objection, complaint to a supervisory authority).
A note on report data and third parties
DMARC reports describe mail infrastructure — which servers sent mail claiming to be your domain. Sending-server IP addresses can qualify as personal data in some jurisdictions. We process them on your instructions, for the sole purpose of DMARC monitoring, under your authority as the domain owner.
Children
The service isn't directed at children under 16, and we don't knowingly collect their data.
Changes
We'll post updates here and, for material changes, email account holders before they take effect.