Wraith

Privacy Policy

Draft — not yet reviewed or approved by counsel. Last updated 2026-09-02.

Warning: This is a draft, not a finished legal document

This page describes, honestly and specifically, what data Wraith actually collects and why — derived directly from the implementation, not aspirational language. It has not been reviewed by a lawyer and is not yet aligned to UAE data-protection requirements (PDPL) or any other applicable regime. See OWNER-ACTIONS.md in the project repository.

What we collect

The minimum needed to run one assessment and deliver its report:

  • The domain name you enter, and the DNS records our checks read (all already publicly published by your own domain — that is what the assessment examines).
  • The email address you provide at checkout, used only to send order and report updates for that order.
  • Payment is processed by our payment provider directly; Wraith does not receive or store your card number.
  • A record of the domain-verification attempt (outcome, timestamp, the DNS records observed) and of the order (amount, status, timestamps) — kept for accounting and abuse-prevention purposes.
  • The assessment’s findings and the report generated from them.
  • Ordinary server request metadata (IP address, timestamp) for rate-limiting and abuse prevention, not for tracking or advertising.

What we do not do

No advertising trackers, no sale of personal data, no cross-site tracking, no profile built from your visit beyond what is needed to deliver the assessment you paid for.

Retention

Pending final policy — an explicit, published retention schedule for reports and financial records has not yet been finalized. Today, records are kept indefinitely pending that decision; this will change once a retention policy is approved (see OWNER-ACTIONS.md).

Where your data is processed

Pending — the specific hosting region and any sub-processors (payment provider, email provider) will be listed here once selected and configured.

Your rights

Pending — a concrete process for accessing, correcting, or deleting your data, and the relevant UAE PDPL rights language, will be added once legal review is complete.