Privacy Policy

How SpiderFoot.app handles information.

This policy explains what information is processed when you use our public-source investigation tools, why it is processed, and the choices available to you.

Last updated: July 1, 2028

1. Scope and operator

This Privacy Policy applies to spiderfoot.app and the browser-based OSINT services made available through it (the “Service”). In this policy, “SpiderFoot.app,” “we,” “us,” and “our” refer to the operator of the Service.

SpiderFoot.app is an independent service. It is not operated by the official SpiderFoot project, SpiderFoot HX, Steve Micallef, or Intel 471.

2. Information we process

2.1 Search inputs and investigation records

When you run a scan, we process the identifier you submit, such as a username, email address, or IP address. We may store the query, target type, scan status, returned public-source results, generated summaries, timestamps, and related technical metadata so that the scan can run and appear in your search history.

2.2 Visitor identifier and account information

We use a persistent browser cookie to recognize a returning visitor and associate saved search history with that visitor. The current cookie configuration may retain this identifier for up to ten years unless you clear it, sign out, or request deletion of associated records.

If you choose to connect Google, we may receive and store the account identifier, display name, avatar, and other profile fields returned through the OAuth authorization flow. We do not receive your Google password.

2.3 Network and device information

We may process IP address, country code, browser language, request headers, timestamps, device or browser characteristics, and diagnostic information. When Cloudflare is in front of the Service, Cloudflare-provided visitor and network headers may also be processed. IP lookup requests additionally process the IP address you ask us to inspect.

2.4 Communications

If you email support, we process the address you use, the contents of your message, attachments, and any follow-up correspondence. Please do not send passwords, authentication tokens, or information that is not necessary for your request.

2.5 Analytics, advertising, and cookies

The Service loads Google Analytics and Google advertising technologies. Those providers may use cookies or similar technologies to measure usage, prevent fraud, personalize or measure advertising where permitted, and produce aggregated reporting. Browser controls and applicable consent tools may allow you to limit these technologies.

3. How we use information

We process information to:

  • run username, email, and IP investigations requested by you;
  • organize, save, and display search history and results;
  • authenticate connected accounts and maintain visitor sessions;
  • operate, secure, troubleshoot, and improve the Service;
  • detect misuse, enforce our Terms, and protect users and infrastructure;
  • respond to support, privacy, legal, and abuse inquiries; and
  • meet legal obligations and establish or defend legal claims.

Where a legal basis is required, processing may rely on performance of a contract, our legitimate interests in operating and securing the Service, consent where requested, and compliance with applicable law.

4. Public sources and service providers

To produce results, the Service may send a submitted identifier and limited technical context to supported public websites, Cloudflare services, search providers, API vendors, and AI services when those features are enabled. These third parties process information under their own terms and privacy practices.

We may also use hosting, database, authentication, analytics, advertising, security, and communications providers. We disclose only the information reasonably needed for each provider to perform its function.

We do not sell personal information for money. We may disclose information if required by law, to protect rights or safety, to investigate misuse, or as part of a merger, acquisition, financing, or transfer of the Service, subject to appropriate safeguards.

Providers and public sources may operate in countries different from yours. Where required, we use available contractual or legal safeguards for international transfers, but public-source queries may still be processed in the location where the source operates.

5. Retention and security

We retain information for as long as reasonably necessary to provide search history, operate and secure the Service, resolve disputes, and meet legal obligations. Search and account records may remain until they are deleted, the related visitor or account relationship ends, or a valid deletion request is completed. Backup, security, and legal records may remain for a limited additional period.

We use reasonable administrative and technical measures intended to protect information. No online service can guarantee absolute security. You are responsible for protecting access to your browser, connected account, and any results you export or share.

6. Your choices and rights

Depending on applicable law, you may have rights to request access, correction, deletion, portability, restriction, or objection; withdraw consent; and complain to a relevant data protection authority. We may need to verify your request and may retain information where legally permitted or required.

  • Clear browser cookies to remove the local visitor identifier from your device.
  • Use the account controls to disconnect Google or sign out.
  • Adjust browser and provider settings for analytics and advertising cookies.
  • Email us to request access to or deletion of associated account and search records.

7. Children

The Service is intended for adults and is not directed to children under 18. We do not knowingly invite children to create accounts or conduct investigations. Contact us if you believe a child has provided personal information.

8. Third-party links and public data

Results may link to third-party websites. We do not control their availability, content, accuracy, security, or privacy practices. Public availability does not remove all privacy, confidentiality, contractual, or legal restrictions on how information may be used.

9. Changes to this policy

We may update this policy when the Service, providers, or legal requirements change. We will post the revised policy here and update the date above. Material changes may be highlighted through the Service where appropriate.

10. Contact

For privacy questions or requests, email [email protected]. Please describe your request and provide enough information for us to identify the relevant browser identifier or connected account without sending unnecessary sensitive data.