Privacy policy.
How DigiAsh collects, uses and protects personal data. It describes what the service actually does, and is updated whenever that changes. Last updated October 2026.
Who is responsible for your data
DigiAsh is an independent project operated by its developer, known as DungeonXplorer, who is the data controller for the personal data described here. For any privacy question or request, email contact@digiash.com or use the contact page. DigiAsh is not affiliated with any of the threat-intelligence providers it connects to.
What DigiAsh collects, and why
- Account data: your email address, a salted hash of your password (never the password itself), your last two previous password hashes (so a recent password can't be reused), when your password was last changed, how you sign in, and your two-factor settings (an encrypted authenticator secret and hashed recovery codes). Why: to provide your account. Lawful basis: performance of a contract with you.
- Your third-party API keys: encrypted with AES-256-GCM before storage, and decrypted only for the moment a lookup you request is running. Why: to run lookups on your behalf. Lawful basis: contract.
- Search history: the indicators you looked up, their risk score and when. Why: so you can review your recent lookups. Lawful basis: contract.
- Security records: counts of failed sign-in attempts (stored under hashed identifiers), rate-limit counters, and the IP address and request details Cloudflare processes when you use the site, including for bot checks. Why: to protect accounts and the service from abuse. Lawful basis: legitimate interests in keeping the service secure.
- Account emails: email confirmation, password resets, and security notices (for example, if someone tries to sign up with your address). Why: to operate and secure your account. Lawful basis: contract and legitimate interests.
- Contact-form messages: your name, email and message. Why: to reply to you. Lawful basis: legitimate interests in responding to enquiries.
What DigiAsh never stores
- Your password in readable form: only a one-way PBKDF2 hash with a unique salt.
- Your API keys in readable form once saved.
- Payment information: DigiAsh doesn't take payments.
- Advertising or tracking data.
How long data is kept
- Account data and API keys: until you delete them or your account. An account whose email address is never confirmed is deleted automatically after 7 days.
- Search history: your most recent 50 searches; older ones are deleted automatically.
- Search results: up to 5 minutes in Cloudflare's cache, so searching the same thing again shows the saved result without querying the providers (and using your quotas) again. Only your account can see them, and they are deleted automatically.
- Failed sign-in records: only for the lockout window, from minutes up to a day (the limit on emails sent to one address).
- Password-reset and confirmation links: unusable after use, or after 30 minutes and 24 hours respectively; their records are deleted after 24 hours.
- Error logs: if something goes wrong, Cloudflare keeps the error message for 3 days so it can be fixed, and the operator is emailed the page and error (at most once an hour). Neither includes what you searched, your email address or your keys.
- Contact-form messages: until your enquiry has been handled, and removed with your account.
Who else processes your data
- Cloudflare hosts DigiAsh (Workers, D1 database, KV storage), provides the bot check (Turnstile) and DNS lookups, and processes standard request metadata such as your IP address. It acts as a processor on DigiAsh's behalf.
- Resend sends account emails. It receives your email address and the message.
- Have I Been Pwned (Pwned Passwords) checks new passwords against known breaches. Only the first 5 characters of the password's SHA-1 hash are sent, so the service can't tell which password was checked.
- The threat-intelligence providers you choose (such as VirusTotal, AbuseIPDB, urlscan.io and the others you add keys for) receive the indicator you search (for a full URL, the whole address including any path and query), using your own key. They process it as independent organisations under their own terms and privacy policies. When urlscan.io has no existing scan for a domain, DigiAsh submits one as unlisted, so it doesn't appear in urlscan.io's public feed, although urlscan.io may make it available to its vetted customers under its own policy.
- ipwho.is and domain registries (RDAP) receive the searched indicator to provide network and registration details.
DigiAsh does not sell personal data, share it for advertising, or use your lookups for any purpose other than returning results to you.
Pages, scripts and fonts are served from digiash.com itself. DigiAsh uses no analytics, advertising or font services, so your browser doesn't contact Google or similar companies when you visit. The only other service your browser loads anything from is Cloudflare's bot check on forms.
Transfers outside the EU
Cloudflare and Resend are based in the United States, so some data may be processed there. These transfers rely on the safeguards those providers offer in their data processing terms, such as the EU–US Data Privacy Framework and the European Commission's Standard Contractual Clauses.
Cookies
DigiAsh uses only strictly necessary cookies: a session cookie that keeps you signed in (deleted when you close your browser, and ended after 30 minutes without activity or 12 hours after you log in), a short-lived cookie during two-factor sign-in, and a short-lived cookie during "Continue with Cloudflare". None are used for advertising, tracking or analytics, and no third-party cookies are set.
Your rights
Under the GDPR you have the right to:
- Access your data and take it with you (portability): use Download my data in the Security panel of your dashboard.
- Erase your data: use Delete account in the Security panel. Your account, search history, API keys and settings are deleted immediately.
- Correct inaccurate data, restrict or object to processing based on legitimate interests: email contact@digiash.com.
- Complain to a data protection supervisory authority, in particular the one in the EU country where you live or work.
Requests by email are answered within one month. You may be asked to confirm a request from the email address on your account.
Security
Data is protected with encryption, hashed credentials, two-factor authentication, session controls, rate limiting and strict security headers; the Security Policy describes the controls in full. If a personal data breach is likely to affect you, you will be told without undue delay.
Other information
- DigiAsh is not intended for anyone under 16 years of age.
- The risk score describes IP addresses, domains and files, not people. DigiAsh makes no automated decisions about you with legal or similarly significant effects.
- Providing your email address and a password (or using Cloudflare sign-in) is necessary to create an account; everything else is optional.
Changes to this policy
When what DigiAsh collects or how it uses data changes, this page is updated first, and the date at the top changes with it.