Privacy Policy

Scope and contact

This policy covers AEGLIX MIND and its Guardian, Intel, CVEs, News, Investigate, Public OSINT, Campaigns, ModelDex and Arsenal workspaces on aeglixmind.com and its product subdomains. Aeglix Security Research operates the platform. For privacy questions or requests, contact aeglixmind@gmail.com.

Information we handle

We store submitted URLs, scan timestamps, risk scores, provider results, machine-learning output, available AI assessments and scan options. Records may include a client IP address and an anonymous session identifier or account association. Feedback can include a vote and an optional comment. Account records include your email address, username, password hash, email verification status and Terms acceptance timestamp. Optional profile details include your display name, organization, job title and bio. Account preferences include appearance, time zone and default history ordering. Sessions also record the original sign-in time for sensitive-action verification. Email verification and password recovery store only hashes of expiring action tokens, with their purpose and expiry time. Google or GitHub sign-in also stores the provider identity linked to your account. We use provider access tokens during sign-in and do not retain them as account credentials. If you email us, we receive the information in that message.

Investigations, campaigns and public sources

Indicator searches combine available public intelligence, reviewed campaign indicators and the requester’s own saved scan history. Investigation responses and downloadable reports may contain that personal history; protect exported files. We also store public-source intelligence and incoming OTX/CISA reports. Incoming reports are private pending review, and public campaign records are separate from users’ private scan histories.

Why we process this information

We use data to perform requested security checks, return and explain results, provide history and reports, process feedback, maintain intelligence sources and operate the service. We also use operational records for security, abuse prevention, troubleshooting and service improvement. Platform statistics can summarize scan activity without exposing another user’s individual history.

Threat providers and AI analysis

Depending on the check, a URL, domain, IP address or URL hash may be sent to VirusTotal, Google Safe Browsing, PhishTank, URLhaus, ThreatFox, AbuseIPDB or DNS blocklist services. Their handling and retention are governed by their own policies. When NVIDIA Nemotron augmentation is enabled, NVIDIA receives the submitted URL and available scan context, which can include provider verdicts, model output, content or reputation analysis and relevant prior scan summaries. Diagnostic model comparisons, when enabled, may also retain submitted URLs and analysis outputs in service logs.

Hosting and other third parties

Guardian message checks are separate from saved URL scans. Screenshots are processed temporarily on our server to extract text. You can review and redact the extracted text before explicitly agreeing to send it to NVIDIA for scam analysis. AEGLIX does not save these messages, uploaded images or assessment results to your account, scan history or training datasets. NVIDIA processing is subject to its own policies. Avoid submitting passwords, one-time codes, financial details or unnecessary personal information.

Model improvement uses a separate, private research review process. Submitted messages and screenshots are not automatically used for training. URL training examples must have permission, source evidence and an explicit reviewed label before export to a training dataset. Withdrawn research records are excluded from future exports; previously trained model artifacts may require retraining to remove their influence. Ordinary scan feedback is not automatically accepted as verified truth.

The deployed service uses Render for application hosting, Supabase PostgreSQL and, for Arsenal catalog storage, MongoDB Atlas and Cloudflare for domain proxying and delivery. These services process information needed to provide their functions, such as application data or connection metadata. Processing locations and retention depend on their configurations and terms, and may be outside your country. Links to news articles, vendor reports and other external sites take you to services with their own privacy policies.

Account emails

When configured, Google Gmail or Resend delivers verification and password-recovery messages. The selected delivery provider receives the recipient email address and message content, including the action link, under its own processing and retention terms. Verification links expire after one hour and recovery links after 30 minutes; each works once. These are account-security messages, not marketing subscriptions.

Browser storage and cookies

We use local browser storage for an anonymous scan-history identifier and theme preference. On our HTTPS product domains, the history identifier can be shared through an hg-session preference cookie for up to 90 days, and the hg-theme preference cookie for up to one year. Local storage remains until cleared or changed. Your account may also store a preferred display name, or a name supplied by your sign-in provider, for your greeting and initial avatar. Account authentication uses HttpOnly session and rotating refresh cookies, plus a short-lived JWT in localStorage. Only a hash of the refresh credential is stored on the server. Sessions expire after 12 hours, or 30 days when Remember me is selected. Local storage is accessible to scripts running on this site; use a trusted device and keep your browser secure. Signing out revokes the current account session and clears its browser credentials. These are functional uses, not advertising features. Clearing browser storage can disconnect you from anonymous history; it does not itself delete server-side records.

Retention and deletion

Scan results and intelligence records are retained to support service functionality, research and operations; we do not promise a fixed automatic deletion period. Clearing your history removes saved scan records accessible to your current account or session and their associated feedback. Provider-held copies, exported reports, caches, logs and backups may persist separately. You can edit optional profile details on your Profile page and permanently delete your account through Settings after confirming ownership. Account deletion removes your profile, saved account scans and their feedback, provider sign-in identities, password-reset tokens and sessions. It leaves unrelated accounts, anonymous history and shared intelligence intact. For additional access, correction, deletion or retention requests, contact us; we may need to verify ownership before acting. Applicable legal or security obligations may limit deletion.

Security and sensitive submissions

We restrict access to account/session history and the private feed-review inbox. No security measure eliminates all risk. Do not submit password-reset links, private internal URLs, signed download links, credentials, API keys or URLs containing sensitive personal information. Treat submitted indicators as information that external security providers may receive. Do not send authentication or session tokens in a support email.

Policy updates

We may update this policy as the platform changes. The date above identifies the latest revision. Review this page before submitting sensitive information, and contact us if you need clarification.

ModelDex discovery and assistant

ModelDex uses the platform account service to identify signed-in users and check catalog administration permissions. Public model discovery does not require administrator access. Catalog entries, provider-supplied imports, source evidence, import activity and administrative changes are stored to operate and maintain the directory.

Assistant messages remain in the current page’s memory and are sent to ModelDex to interpret requirements and search the catalog; they are not saved as a chat history or added to your Guardian scan history. Reloading the page clears the conversation. When you opt into available NVIDIA AI assistance, the conversation requirements are sent to NVIDIA under its own policies. Local interpretation remains available without that opt-in. Do not include secrets, customer records or unnecessary personal data.

Daily AI usage counters are stored for signed-in users and the service to enforce request limits; they do not contain message text or AI responses. Model comparison selections use browser session storage for public model identifiers and names. Provider API credentials used for catalog synchronization remain server-side and are not public catalog fields. Operational access and security logs may record connection metadata and request paths.

Arsenal discovery and catalog data

Arsenal stores security-tool metadata, public repository and documentation links, source evidence, import activity, review decisions and administrative audit records. Public discovery does not require administrator access. Platform sign-in can identify your account, but it does not grant catalog administration permissions.

The floating catalog helper currently uses local matching and requests to Arsenal’s catalog search endpoint; it does not send conversations to an external AI model. Conversation text stays in the current page’s memory, while the derived search query or category is sent to our server. Reloading clears the conversation. Request paths, including search parameters, may appear in operational logs. Do not enter secrets or personal records.

Tool comparison selections and the helper button’s position use browser session storage. Theme preferences use the platform’s functional browser storage and cookie. Imports retrieve public metadata from configured source services. When configured, a VirusTotal lookup sends a repository URL to retrieve an existing reputation record; Arsenal does not upload or execute tool binaries as part of this check. External repositories and documentation sites apply their own privacy policies when you follow their links.

Catalog and source evidence are shared intelligence records, separate from your private Guardian scan history. Contact us with a listing URL and supporting evidence for a correction, removal or privacy request. Administrative credentials remain server-side or in the current administrator page’s memory; do not include them in support messages.

Public OSINT searches, images and notes

The Public OSINT workspace is separate from saved Guardian scans. A search sends its submitted name, handle, organization, domain or IP address to the sources used for that mode: Wikidata and Wikipedia for public references; GitHub, GitLab, Wikimedia and Bluesky for public accounts; GLEIF for legal entities; Google Public DNS and crt.sh certificate transparency for domains; and RIPEstat for public IP routing and registration context. Each provider applies its own privacy and retention terms. Provider requests are made by our service without forwarding your account credentials.

Public-source responses are cached temporarily for up to ten minutes. Searches and results are not saved to your account or added to the public intelligence archive. Temporary research notes stay in the current page’s memory until you clear, leave or reload it, unless you download a JSON export. Operational logs may record connection metadata and endpoint paths; this is not a promise of anonymous use.

Uploaded JPEG, PNG and WebP images are processed temporarily on our server for dimensions, a SHA-256 fingerprint and selected embedded metadata. They are not retained as files or used to train our models. If you select optional visual analysis, resized image pixels are sent to NVIDIA under its processing and retention terms. We remove embedded EXIF and GPS from that copy; visible personal information remains. Without this opt-in no image is sent to an external AI provider. A separate optional research check sends up to four visible or tentatively logo-derived public organization, brand, event or place names to Wikidata and English Wikipedia, and up to two suggested public-place names to OpenStreetMap/Nominatim and Wikidata. Your image and embedded GPS are not sent to these research sources. Map search responses and place names can be cached in server memory for up to one hour (up to 200 searches). Embedded GPS, when requested, is compared with map results locally. Local OCR and QR/barcode extraction run on our server without opening decoded links. When you opt into NVIDIA visual analysis, extracted OCR lines may accompany the image to help interpretation. User-triggered nearby-feature searches send a candidate coordinate, selected public feature category and radius to the Overpass API; results can be cached in memory for ten minutes. Clicking Show map loads an OpenStreetMap frame, sharing your browser connection metadata and the candidate map position with that provider. Reference-image links open Wikimedia Commons, where licensing and provider terms apply. Providers apply their own processing policies. Embedded GPS coordinates are returned only when you explicitly select that option. Reverse-image service links open external services; AEGLIX does not automatically send your uploaded image to them. Timestamped exports can include hashes of normalized provider records; these are not signed or independently authenticated archives. Exports can contain public personal data, private notes and image coordinates; protect your copies. To request a correction or raise a privacy concern, use our Contact page.