OSINT.SX Privacy Policy

Last Updated: October 23, 2026

1. Information We Collect

We don't ask for your name, email address or phone number. To run your account we store:

Account: an internal user ID, your login key, when the account was created and when you last logged in, and whether the account is an admin account or has been suspended (with the reason).
Credits and plans: your credit balance, your subscription (plan, status, renewal and cancellation dates), and a daily usage counter for each tool.
Payments: your Stripe customer and subscription IDs, records of the Stripe payments and refunds we process, your wallet balance, and a ledger of wallet deposits and spending. For cryptocurrency deposits the ledger includes the transaction ID, network and currency reported by Heleket.
Referrals: your referral code, the account that referred you (if any), how many people you have referred, and the credits earned.
Ad visits: if you came to the site from an ad or a tagged link, the ad click ID (such as Google's gclid) and campaign tags in that link, the page it opened and when. We use them to see which ads lead to purchases.
API keys: a one-way hash of each API key you create and when you created it. We cannot see the key itself after it is shown to you.
Usage counts: how many searches your account runs each day. We store the number, not what you searched.

We do not store the email addresses, phone numbers, usernames, names or links you search in our database.
To answer a search we send the identifier you entered to the websites and services being checked, often through proxy providers.
If a source fails, the error may be written to our server logs. The identifier you searched is removed from it first. Server logs are overwritten as they fill.
Your search history (what you searched and the results) is saved only in your browser's local storage, up to 25 searches. You can clear it on the History page.

We use your IP address to apply rate limits. It is stored for about a minute and then deleted automatically. We do not keep request logs of IP addresses.
We set one cookie, session, which keeps you logged in for up to 30 days. It cannot be read by scripts on the page and contains only your user ID and whether you are an admin.
Your browser also stores a few items the site needs: your search history, a logged-in marker (and, after you log out, one that keeps that tab logged out), a pending referral code, the ad click ID and campaign tags of an ad visit until you create an account (up to 90 days), which version of our prices you see while we test them, the amount and payment method of your last purchase (so the next one can be pre-filled), temporary payment details while a checkout is in progress, your light or dark theme choice, whether you closed a notice during your visit, and a short-lived marker that stops the login page sending you back and forth. Your account also stores the price version its browser had when the account was created, so you see the same prices on any device you log in on.
Third-party services listed below may set their own cookies.

These services receive data when you use OSINT.SX:

Stripe: card payments and billing. You enter your card and billing details with Stripe directly; we send Stripe your user ID with each checkout. See Stripe's Privacy Policy.
Heleket: cryptocurrency payments and wallet deposits. For credit purchases the order reference includes your user ID. See Heleket's Privacy Policy.
Cloudflare: DDoS protection, content delivery and Cloudflare Turnstile CAPTCHA verification. See Cloudflare's Privacy Policy.
Plausible Analytics: counts page visits on every page so we can see how the site is used. It also records when someone opens the payment page, presses Pay and completes a payment, with the payment method, the amount, whether the account is new, and which version of our prices was shown. It is loaded from a.osint.sx and does not use cookies.
Proxy, data and CAPTCHA-solving providers: searches, including tool searches, pass through proxy providers, and some tools query data providers or CAPTCHA-solving services. They receive the identifier being searched, not your account details.

Running your account: logging you in, keeping your credits, plan and wallet balance, and enforcing daily limits.
Payments: processing purchases and renewals, handling refunds and chargebacks, and paying referral rewards.
Security and abuse prevention: CAPTCHA checks, rate limits, and suspending accounts that break our Terms.
Keeping the service working: fixing failing sources from error reports, and aggregate statistics such as daily search and signup counts.

Deleting your account removes your account record immediately: your login key, API keys, credits, wallet balance, plan, referral code and usage counters. An active card subscription is canceled.
Some records stay after deletion, linked to your former user ID: the wallet ledger, the referral ledger, wallet subscription renewal records and daily usage counts. We keep them for accounting and fraud prevention. Stripe and Heleket keep their own records of your payments, including your Stripe customer record.
Accounts that have never paid, hold no credits or balance, and have not been logged into for 30 days are deleted automatically.

The site and API are served over HTTPS.
API keys are stored only as one-way hashes.
The session cookie is HTTP-only and, in production, sent only over secure connections.
Your login key is the only way into your account and cannot be recovered. Keep it somewhere safe.

You can:

We will post any updates to this Privacy Policy on this page. If material changes are made, we will update the date at the top.

For any privacy-related questions, please contact: contact@osint.sx

By using OSINT.SX, you agree to this Privacy Policy.