Privacy Policy

Scope and contact

This policy covers AEGLIX MIND and its Guardian, Intel, CVEs, News, Investigate and Campaigns workspaces on aeglixmind.com and its product subdomains. Aeglix Security Research operates the platform. For privacy questions or requests, contact aeglixmind@gmail.com.

Information we handle

We store submitted URLs, scan timestamps, risk scores, provider results, machine-learning output, available AI assessments and scan options. Records may include a client IP address and an anonymous session identifier or account association. Feedback can include a vote and an optional comment. Account records include your email address, username, password hash, email verification status and Terms acceptance timestamp. Optional profile details include your display name, organization, job title and bio. Account preferences include appearance, time zone and default history ordering. Sessions also record the original sign-in time for sensitive-action verification. Email verification and password recovery store only hashes of expiring action tokens, with their purpose and expiry time. Google or GitHub sign-in also stores the provider identity linked to your account. We use provider access tokens during sign-in and do not retain them as account credentials. If you email us, we receive the information in that message.

Investigations, campaigns and public sources

Indicator searches combine available public intelligence, reviewed campaign indicators and the requester’s own saved scan history. Investigation responses and downloadable reports may contain that personal history; protect exported files. We also store public-source intelligence and incoming OTX/CISA reports. Incoming reports are private pending review, and public campaign records are separate from users’ private scan histories.

Why we process this information

We use data to perform requested security checks, return and explain results, provide history and reports, process feedback, maintain intelligence sources and operate the service. We also use operational records for security, abuse prevention, troubleshooting and service improvement. Platform statistics can summarize scan activity without exposing another user’s individual history.

Threat providers and AI analysis

Depending on the check, a URL, domain, IP address or URL hash may be sent to VirusTotal, Google Safe Browsing, PhishTank, URLhaus, ThreatFox, AbuseIPDB or DNS blocklist services. Their handling and retention are governed by their own policies. When NVIDIA Nemotron augmentation is enabled, NVIDIA receives the submitted URL and available scan context, which can include provider verdicts, model output, content or reputation analysis and relevant prior scan summaries. Diagnostic model comparisons, when enabled, may also retain submitted URLs and analysis outputs in service logs.

Hosting and other third parties

Guardian message checks are separate from saved URL scans. Screenshots are processed temporarily on our server to extract text. You can review and redact the extracted text before explicitly agreeing to send it to NVIDIA for scam analysis. AEGLIX does not save these messages, uploaded images or assessment results to your account, scan history or training datasets. NVIDIA processing is subject to its own policies. Avoid submitting passwords, one-time codes, financial details or unnecessary personal information.

The deployed service uses Render for application hosting, Supabase PostgreSQL for database storage and Cloudflare for domain proxying and delivery. These services process information needed to provide their functions, such as application data or connection metadata. Processing locations and retention depend on their configurations and terms, and may be outside your country. Links to news articles, vendor reports and other external sites take you to services with their own privacy policies.

Account emails

When configured, Google Gmail or Resend delivers verification and password-recovery messages. The selected delivery provider receives the recipient email address and message content, including the action link, under its own processing and retention terms. Verification links expire after one hour and recovery links after 30 minutes; each works once. These are account-security messages, not marketing subscriptions.

Browser storage and cookies

We use local browser storage for an anonymous scan-history identifier and theme preference. On our HTTPS product domains, the history identifier can be shared through an hg-session preference cookie for up to 90 days, and the hg-theme preference cookie for up to one year. Local storage remains until cleared or changed. Your account may also store a preferred display name, or a name supplied by your sign-in provider, for your greeting and initial avatar. Account authentication uses HttpOnly session and rotating refresh cookies, plus a short-lived JWT in localStorage. Only a hash of the refresh credential is stored on the server. Sessions expire after 12 hours, or 30 days when Remember me is selected. Local storage is accessible to scripts running on this site; use a trusted device and keep your browser secure. Signing out revokes the current account session and clears its browser credentials. These are functional uses, not advertising features. Clearing browser storage can disconnect you from anonymous history; it does not itself delete server-side records.

Retention and deletion

Scan results and intelligence records are retained to support service functionality, research and operations; we do not promise a fixed automatic deletion period. Clearing your history removes saved scan records accessible to your current account or session and their associated feedback. Provider-held copies, exported reports, caches, logs and backups may persist separately. You can edit optional profile details on your Profile page and permanently delete your account through Settings after confirming ownership. Account deletion removes your profile, saved account scans and their feedback, provider sign-in identities, password-reset tokens and sessions. It leaves unrelated accounts, anonymous history and shared intelligence intact. For additional access, correction, deletion or retention requests, contact us; we may need to verify ownership before acting. Applicable legal or security obligations may limit deletion.

Security and sensitive submissions

We restrict access to account/session history and the private feed-review inbox. No security measure eliminates all risk. Do not submit password-reset links, private internal URLs, signed download links, credentials, API keys or URLs containing sensitive personal information. Treat submitted indicators as information that external security providers may receive. Do not send authentication or session tokens in a support email.

Policy updates

We may update this policy as the platform changes. The date above identifies the latest revision. Review this page before submitting sensitive information, and contact us if you need clarification.