This Privacy Policy applies to https://theadminstack.com, including every tool on it, its blog, and the x365 admin console at theadminstack.com/x365 (together, the "Site"). The Site is operated by TheAdminStack from Singapore ("we", "us"). This policy explains how we handle personal data under Singapore's Personal Data Protection Act 2012 (PDPA) and, where it applies to you, the EU/UK GDPR.

1. Information We Collect

We collect as little as possible. You never need a TheAdminStack account to use the Site.

a. Information you give us

If you use the contact form, we collect your name, email address, company (optional), the service you're asking about (optional) and your message. It is stored in our database and emailed to our own inbox so we can reply. Your name, email address and message are needed for us to reply; the other fields are optional. Using the form is voluntary — if you'd rather not provide these details, we simply can't respond. To stop abuse, your IP address is also recorded for a short time to rate-limit form submissions (see Section 8).

b. Information collected automatically

  • Request data. When you visit, our content-delivery network (Cloudflare) and hosting provider (Hostinger) process standard request data — IP address, browser/device type, requested URL, referrer and timestamp — to deliver and secure the Site.
  • Tool usage logs. Some OSINT tools (for example NetRecon, TenantRecon, MS Tenant Lookup and the subdomain-enumeration sources) log each lookup as a one-way hash of the value you queried and a hash of your IP address that changes daily. We use these for rate limiting and aggregate usage counts; we don't store the raw IP address or the query in these logs.
  • First-party IP–domain index. When the DNS Toolkit or NetRecon resolves a domain, the resulting domain → IP address pair is saved to a shared index that powers "other domains on this IP" lookups. The index records public DNS data only — it does not record who ran the lookup.

c. Cookies and browser storage

We use only essential cookies. We do not use advertising or cross-site tracking cookies.

  • tas_consent — remembers that you've dismissed the cookie notice so it isn't shown on every page. Set on .theadminstack.com for 12 months.
  • PHP session cookie (PHPSESSID) — keeps forms secure (CSRF protection), shows confirmation messages, and keeps administrators signed in. It is HTTP-only, secure, and expires when you close your browser.

Some features use your browser's own storage instead of cookies. Your light/dark theme preference and work you save in tools such as the Risk Register and Control Mapper are kept in localStorage; the x365 console keeps its Microsoft sign-in tokens and query log in sessionStorage, which is cleared when you close the tab. This data stays on your device and is never sent to our servers. You can erase it with a tool's clear/reset option or by clearing site data for theadminstack.com in your browser.

2. How We Use Information

  • To run, secure and maintain the Site and its tools, including rate limiting, abuse prevention and debugging.
  • To reply to messages sent through the contact form.
  • To understand aggregate usage (for example, which tools are popular) so we can decide what to improve.

We do not sell personal data, use it for advertising, or use it to make decisions that have a legal or similarly significant effect on you.

3. Analytics

We use Cloudflare Web Analytics to measure aggregate traffic (page views, referrers, countries and browser types). Its script loads from static.cloudflareinsights.com and reports to cloudflareinsights.com. It does not use cookies, does not fingerprint your device, and does not track you across other websites. See Cloudflare's privacy policy.

4. Tool Inputs and Third-Party Services

a. Tools that run only in your browser

Many tools process what you enter or upload entirely in your browser — for example the Conditional Access Analyzer & Designer, AuthMethods Readiness Analyzer, Token Decoder, Risk Register and Control Mapper. Files and text you load into them are not uploaded to us. The Token Decoder's only network request is an optional fetch of the token issuer's public signing keys (JWKS), made directly from your browser.

b. Tools that look up public data

Lookup tools work by querying public sources about the value you enter (a domain, IP address, email header or DNS record). The value you submit is sent to the relevant service — sometimes directly from your browser, sometimes via our server. Depending on the tool, these include:

  • DNS resolvers — DNS-over-HTTPS queries to Cloudflare (cloudflare-dns.com) and Google (dns.google); for the DNS Toolkit's Propagation tab, queries from our server to public resolvers worldwide (drawn partly from public-dns.info).
  • Certificate Transparency logs — crt.sh and Cert Spotter.
  • Domain and IP registries — RDAP services operated by IANA, the regional internet registries and domain registries.
  • Passive-DNS and recon sources — HackerTarget, AlienVault OTX, RapidDNS and Anubis-DB.
  • IP geolocation — ipapi.co (NetRecon via our server; the Email Header Analyzer directly from your browser).
  • Microsoft — public Microsoft Entra sign-in discovery endpoints (login.microsoftonline.com) for TenantRecon and MS Tenant Lookup. The x365 console signs you in with your own Microsoft account and calls Microsoft Graph directly from your browser; your tokens and tenant data never pass through our servers.
  • The hosts you scan — Subdomain Recon, SquatWatch and NetRecon may connect to the domains you enter (for example to check a web page or TLS certificate).

These services receive the query plus standard request data such as an IP address, and are governed by their own privacy policies. Don't submit confidential values — for example, only paste test or non-production tokens into the Token Decoder.

c. Fonts and libraries

Fonts are served from our own servers. Some tools load open-source libraries from cdnjs.cloudflare.com or unpkg.com (for example the DNS Toolkit's map). When they do, your browser connects to these providers directly, so they receive your IP address and browser details.

5. Advertising

The Site does not currently show advertising and sets no advertising cookies. If we introduce advertising, we will update this policy first and ask for your consent before any advertising cookies are set.

6. Who We Share Data With

  • Service providers that host and deliver the Site and send email for us: Hostinger (web hosting and database), Cloudflare (content delivery, security and analytics) and our email delivery provider.
  • Lookup services described in Section 4, which receive only the values you choose to submit to a tool.
  • Authorities, where required by law or valid legal process.

We do not otherwise sell, rent or trade personal data.

7. International Transfers

Our service providers may store or process data outside Singapore. Where personal data is transferred overseas, we rely on contractual safeguards in those providers' data processing terms — including the EU Standard Contractual Clauses where they apply — to ensure it receives protection comparable to the PDPA (and, for EU/UK data, the GDPR). Contact us for more information about these safeguards or a copy of them.

8. How Long We Keep Data

  • Contact form messages: deleted from our database 24 months after receipt; copies in our email inbox are deleted on the same schedule.
  • Rate-limit records for the contact form and admin sign-in (which include your IP address): deleted within 7 days.
  • Hashed OSINT tool logs: deleted after 12 months.
  • IP–domain index: public DNS data, kept while it is useful for lookups; it contains no visitor data.
  • Request logs held by Cloudflare and Hostinger: kept according to those providers' own retention schedules.
  • Cookies: tas_consent for 12 months; the session cookie until you close your browser.
  • Browser storage: stays on your device until you clear it.

We delete these records on the schedule above.

9. Your Rights

Singapore (PDPA)

You can ask to access the personal data we hold about you and how it has been used or disclosed in the past year, ask us to correct it, and withdraw consent to our collection, use or disclosure of it. If you withdraw consent for us to use your contact details, we won't be able to continue responding to your enquiry; we'll tell you about any other consequences before acting on your request. We will respond as soon as reasonably possible — generally within 30 days. If you're not satisfied with our response, you may contact the Personal Data Protection Commission (PDPC).

EU/EEA and UK (GDPR)

We rely on our legitimate interests to operate, secure and measure the Site (including essential cookies and cookieless analytics), and on steps taken at your request to answer contact-form messages. You have the right to access, correct, delete or export your personal data, to restrict or object to processing, and to complain to your local data protection authority.

California (CCPA/CPRA)

TheAdminStack does not meet the revenue or data-volume thresholds that make an organisation a "business" under the CCPA/CPRA, so that law does not apply to us. We nonetheless do not sell personal information or share it for cross-context behavioural advertising, and California residents can make the requests described below.

Everyone

Wherever you are, you can clear cookies and site data in your browser at any time, or contact us with questions or requests. We may need to verify your identity before acting on a request.

10. Security

The Site is served only over HTTPS. Tool usage logs store hashes rather than raw IP addresses or queries, and database credentials are kept outside the web root. No method of transmission or storage is completely secure; if a data breach affects your personal data, we will notify you and the relevant authorities where the law requires it.

11. Children

The Site is for IT, security and compliance professionals and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has sent us personal data, contact us and we'll delete it.

12. Contact and Data Protection Officer

For questions about this policy, or to make an access, correction, deletion or withdrawal-of-consent request, contact our Data Protection Officer at [email protected] or use the contact form.

13. Changes to This Policy

We'll update the "Last updated" date above whenever this policy changes, and highlight material changes — such as introducing advertising — on the Site before they take effect.