Privacy policy.

Ohey is a brand of Rogue Infosec Inc.. This policy explains how we handle personal information through ohey.ca and the domains that redirect to it.

Who is responsible

Rogue Infosec Inc. is responsible for personal information under its control. Our Privacy Officer handles privacy questions, access and correction requests, consent withdrawals and complaints.

What this website collects

This website offers on-demand website checks and an account portal. Ohey admins can assign client plans for scheduled website checks. Public signup and payments are not available.

When you submit a check, we receive the domain or public IP address, your verification response and technical request information. Our scanner visits the public website and collects response content and security evidence to produce a result. We also send the submitted domain or public IP address to reputation providers to check for threat reports. Do not submit credentials, private URLs or personal information in the domain field.

The portal scanner accepts a public URL and optional HTTP Referer. It records browser interactions, response content, screenshots, network requests and observed clipboard activity as scan evidence. Do not enter passwords or personal information into the scan browser. Captures stay on our scanner infrastructure; account sign-in stays in Cloudflare.

Portal accounts include your name, email address, access permissions and security settings. We store password hashes, protected authenticator and passkey credentials, hashed recovery codes and tokens, and essential session records in Cloudflare D1. Client plans also store website hostnames, domain verification records, optional client labels, alert preferences and encrypted check history. Scheduled checks send the website hostname to our scanner and reputation providers; those services do not receive your portal credentials or client account details.

When you visit, our hosting and network providers process technical information such as your IP address, request time, browser details, requested URL and connection information. This helps deliver the website, prevent abuse and troubleshoot problems.

If you contact us, we receive your name, email address, optional website and message. Waitlist submissions include your email address, selected plan and consent to hear about Ohey. We store waitlist signups in our database and use Cloudflare Email Sending for signup confirmations and messages to our inbox. Please send only the information needed for your inquiry and avoid sending passwords or other sensitive credentials.

How we use information

• To deliver, maintain and protect the website, manage portal access, run requested and scheduled checks, and send security and monitoring emails.
• To analyze scan evidence, identify threats and maintain security research records.
• To respond to inquiries and privacy requests.
• To email waitlist members about Ohey and plan availability, with their consent.
• To investigate errors, security incidents and abuse.
• To meet applicable legal and record-keeping obligations.

We do not sell personal information or use inquiries to build advertising profiles.

Hosting, security and cookies

Cloudflare hosts the website, portal and account database. We run the scanner and intelligence services on infrastructure we manage. Cloudflare processes request information and may use security cookies or browser checks to distinguish legitimate visitors from automated abuse. We use Cloudflare Turnstile to verify website checks, contact messages and waitlist submissions; its processing is described in the Turnstile Privacy Addendum. See Cloudflare’s privacy policy and cookie information.

The checker sets a secure, essential session cookie to protect submissions and restrict access to results to the browser that requested them. The checker session expires after 20 minutes. The portal uses a separate secure, essential sign-in cookie; portal sessions expire after 12 hours and can be revoked in Account settings. We do not use advertising trackers or analytics cookies. Fonts and images are served from our own website. You can control cookies through your browser; blocking security cookies may affect access when a security check is required.

Service providers and disclosures

Our hosting, network security and email providers process information needed to provide their services. They may process information outside Canada, where different privacy laws apply. We may also disclose information when required by law or when necessary to investigate or prevent misuse of the website.

Links to research and other external websites are governed by those websites’ own privacy practices.

Retention and safeguards

We keep technical records and correspondence for as long as needed for the purposes described here, including security and legal requirements, then delete or anonymize them. Retention periods depend on the kind of record and the services involved. Browser result links expire after 10 minutes. Scan evidence and security research records may be retained longer for threat analysis and abuse prevention; expiry of a result link does not delete that evidence.

Portal monitoring history is retained for the plan’s history period: 30 days, one year or two years. Removing a monitored website removes its portal check history. Scanner evidence may be retained separately for the security research purposes described above. Account security challenges and reset links have short expiry periods; recovery codes are single-use.

We use encrypted connections and restrict administrative access. No method of transmission or storage can guarantee complete security.

Your choices and privacy requests

You can pause website monitoring, remove websites and turn monitoring email alerts off in the portal. Account settings let you update your name, password, authenticator and passkeys, and revoke sign-in sessions.

To leave the waitlist, email hey@ohey.ca or reply to a waitlist email.

You can request access to personal information we hold about you, ask for corrections, or withdraw consent where our processing relies on it. Contact privacy@rogueinc.org. We may need to verify your identity, and legal or security obligations may limit what we can delete or disclose.

We will review privacy concerns you raise with us. You can also contact the Office of the Privacy Commissioner of Canada.

Changes

We will update this page and its effective date when our privacy practices change. If we introduce new services, we will explain any associated changes in how information is collected and used.