TGG / PRIVACY

Privacy

Updated 3 November 2026. TGG’s website security-check service is operated by JULC Limited, registered in the British Virgin Islands (BVI). Contact: dev@tgg.group.

01Information we process

Browsing the main website does not require an account. Its contact form opens your email application; you decide whether to send the message. The security-check service requires a verified account. If you enter an email before registration, we use it to show the website domain and check basic signup eligibility. That preview does not verify the mailbox, create an account or send an email. The email is carried into the sign-up form without placing it in a URL. We process your account identifier and verified email, the hostname you submit, the verified email used for the request, your authority declaration, terms acceptance and their time and revision, a keyed hash of the request’s source address, job and delivery status, and the resulting configuration report. Hosting and authentication providers also process technical request, session and abuse-prevention data.

02Why we use it

We use this information to authenticate you, verify mailbox access and the email/hostname match, record your declared authority, carry out the limited check you request, provide your private report, enforce usage limits, prevent abuse and respond to support or privacy requests. If you select email delivery, we send a short summary, the hostname and a sign-in-protected report link to your verified primary address. Requesting a report does not subscribe you to marketing.

03What the check collects

The service checks the target’s public DNS addresses and makes one unauthenticated HTTPS HEAD request to the approved hostname’s root on port 443. It does not follow redirects, execute website scripts, authenticate to the target, or inspect application logic. The stored report contains bounded certificate and response-policy observations. Raw response headers, cookies and page bodies are not stored in the report. The outbound request carries an opaque request reference that TGG can link to the private requester record. Your email is not included in the request sent to the target server. The private report includes your requesting email and accepted scope/terms reference. Reports are generated by fixed rules; customer reports are not sent to the locally installed language model.

04Service providers and international processing

We use Vercel for hosting, isolated checks and background delivery; Clerk for account and session management; Neon for the application database; and Resend for requested transactional email. These providers receive the information needed for their functions. Hosting and support may involve processing outside your country, including the United States and Europe. A selected email sending region does not limit where Resend stores data. Read the providers’ Vercel, Clerk, Neon and Resend notices for their processing and transfer arrangements. We do not sell personal information.

05Sessions and browser storage

The account service uses cookies or browser storage needed for sign-in and session security, and may use device and request signals for abuse prevention. We do not add advertising pixels or advertising identifiers to this service. Authentication and hosting providers’ security processing is described in their notices.

06Retention and access

Application job records, reports, notification records and the associated requester/authorization audit records are scheduled for removal after 30 days. Your authentication account remains until it is deleted or otherwise removed under the account provider’s policies. Provider delivery logs, security logs and backups have their own retention periods; deleting an application report does not instantly erase those copies. Email already delivered to your mailbox is controlled by you and your email provider. Reports require sign-in to the account that requested them; authorized operators and service providers may access data when needed for support, security or legal obligations. If a website operator raises a concern about a request, we may use its reference to investigate and disclose necessary information where lawful and appropriate. Requester details are not published in a public lookup service. Verification records from the earlier DNS-based flow follow the same application retention schedule.

07Your choices and requests

Email delivery is optional. You can use the service to read a report online, sign out when finished, and contact dev@tgg.group to request access, correction, deletion, account closure or information about international processing, or to raise a privacy concern. We may verify your identity before acting and retain limited information where law or a security investigation requires it. We handle requests and applicable rights under the laws that apply to you and the service. See the BVI Data Protection Act, 2021 for the BVI framework.