1. Scope
This policy applies to openbimi.com and its current anonymous checker, setup wizard, local logo tools, local email-header inspector, record builder, and learning pages. Managed hosting, accounts, notifications, and domain claims are not currently available; this policy will be updated before those features launch.
2. Information processed
Public-domain checks
When you check a domain, the server receives the domain and optional BIMI selector. It queries public DNS records and may request the public HTTPS logo or certificate URL published in those records. The application returns the result to your browser and does not intentionally store a report history.
Logo artwork
Files selected in the logo converter, SVG validator, or setup wizard are processed locally in your browser. Original artwork is not uploaded to OpenBIMI.
Email headers
Headers pasted into the header inspector are parsed locally in your browser. They are not submitted to OpenBIMI. Headers can contain personal information such as email addresses, IP addresses, message IDs, and mail-routing details, so do not share them publicly without review.
Technical request data
Our hosting provider may process normal web-request information needed to deliver and secure the site, such as IP address, user agent, requested path, timestamps, and runtime logs. Its handling and retention are controlled by the hosting platform and our project configuration.
3. What the current site does not use
- No general user accounts.
- No advertising or cross-site tracking.
- No marketing mailing list.
- No DMARC aggregate-report ingestion.
- No intentional storage of anonymous checker results, original artwork, or pasted headers.
The site may use strictly necessary platform mechanisms required for security or delivery. If analytics or optional notifications are added later, this policy and the interface will be updated first.
4. Service providers and international processing
OpenBIMI is hosted on Vercel. Requests can be processed through infrastructure in multiple countries. Public DNS resolvers and the third-party hosts that serve a domain’s published BIMI files also receive the technical requests necessary to answer a check.
5. Security and retention
Remote requests are bounded by protocol, address, redirect, timeout, and size checks. Local-tool content remains in the current browser tab unless you download it. Normal platform logs may remain for the period provided by Vercel or required for security, troubleshooting, and legal obligations.
6. Access, correction, and questions
Because the current service does not create user profiles or intentionally retain tool inputs, OpenBIMI will usually have no account record to access or correct. For a general privacy question, open a GitHub discussion without including private data. For a sensitive security or privacy issue, use the repository’s private security-reporting channel.
7. Changes
Material changes will be reflected by a new “last updated” date. Features that materially change data collection—such as managed hosting, recovery keys, or email alerts—will receive specific disclosures before activation.