Privacy Policy

This is Zenithmark's product privacy notice. It sits under Starhold Software's umbrella privacy policy, which applies to everything Starhold operates.

Who we are

Zenithmark is operated by Copper Jerky LLC, an Arizona limited liability company doing business as Starhold Software. Copper Jerky LLC is the data controller for the personal data described here.

What we do with a domain you enter

To produce the report we query public DNS and perform a TLS handshake with your mail and web servers, and we never send email to the domain. The free scan needs no account. Signing in with a Starhold Account is only for paid monitoring (see “Paid monitoring and the DMARC inbox” below).

What we collect and keep

• The domain you scan and its results — the findings, score and the public DNS and certificate data they were based on, stored as a report.
• A hashed IP address — a peppered hash of your IP, used for rate limiting, treated as personal data, deleted after 30 days. It is stored with the domain and the time. We never store the raw IP address.
• Cookies only if you sign in — a session cookie and a matching anti-forgery cookie, both HttpOnly, removed when you sign out and expiring after 30 days. The free scorecard sets none.
• No access logs — this site keeps no per-request access log. If a request fails, a server error log can record the requesting IP address; we use it only to fix the problem and keep it for 30 days.

Report links (/r/<id>) are public to anyone who has them. They are marked so search engines do not index them.

Paid monitoring and the DMARC inbox

If you subscribe, we also hold, until you remove it or delete your Starhold Account:

• Your account link — the opaque Starhold Account identifier, your plan and billing period, and your email address when Starhold Account has verified it. We use the email only to send you change alerts and a weekly summary; we do not receive your payment details (Polar, the merchant of record, does).
• The domains you monitor and the result of each daily check (kept 90 days).
• DMARC aggregate reports sent by mailbox providers about mail using your monitored domains: the sending server addresses, message counts, pass/fail results and the name of the reporting organisation, kept 90 days. We keep only this parsed summary, not the report file or any email.

Removing a domain erases its history and reports at once. You can export or delete everything from Starhold Account, which tells us to do the same.

Retention

• Reports are kept for 30 days after the scan, then deleted.
• Scan records with the hashed IP are deleted after 30 days.
• Backups — the database is copied off-site nightly; deleted data leaves our backups within 30 days once our restore test is on the pre-launch checklist. Until then a report or scan record that has expired and been deleted from the live database remains in backups until those age out.

To access, correct, or delete your data, use the contact form or write to hello@starhold.dev.

Sub-processors

• Backblaze B2 — off-site storage for database backups.
• Starhold Account — sign-in and your plan (Starhold Software).
• Polar — payments, as merchant of record.
• Postmark — delivers our alert emails and receives DMARC reports for your domains.

We do not sell personal data.

Contact

Copper Jerky LLC, doing business as Starhold Software — contact form or hello@starhold.dev.

Last updated: 24 October 2026.