Privacy Policy
Last updated September 29, 2026
This policy explains what Cameron DeBough, doing business as DeBough Systems (“DeBough,” “we”), collects when you use our website, dashboard, and DeBough Checkup app, and what we do with it.
The short version: we collect the minimum needed to show you what DeBough observed. We never collect your files, documents, emails, browsing, or passwords from your computers. We don't sell your data, and we don't use advertising or tracking cookies.
1. What we collect
Your account. Your email address, a securely hashed password (or email sign-in links), two-step sign-in settings if you turn them on, your company name, and your settings.
From computers running DeBough Checkup. The name you give each computer, its operating system and version, and the results of its security checks: for example whether antivirus, the firewall, disk encryption, automatic updates, and backups are on; the names of known backup products; and the names and versions of installed apps that have updates waiting. Checkup does not read or send your files, documents, emails, browsing history, passwords, Wi-Fi network names, or anything typed on the computer. Where a check involves a saved password (such as automatic sign-in), it only notes that one exists; it never reads it.
Domains you add. The domain name and the results of checks on public information (DNS records, the website's certificate, domain registration, and registered lookalike domains). If you confirm you control a domain and check it for breached accounts, we also keep which addresses at that domain appear in known data breaches: only the part of each address before the @ and the names of the breaches, never passwords or other leaked data.
People you add for security lessons. Their names and work email addresses, which lessons were sent, when they were completed, and quiz scores. If you add staff, please let them know.
Billing. Your plan and its status, and Stripe's reference numbers for your account. Stripe collects and stores your card details; we never see them.
Service records. Basic records of how the Service is used (for example which feature was used and when, and how much AI processing it took). We record a one-way scrambled version of IP addresses, not the address itself, to limit abuse.
2. Things we look at but don't keep
- Emails you check for scams are analyzed and then discarded. If you ask for a plain-English explanation, the sender, subject, and the start of the message are sent to our AI provider to write it, and not stored by us.
- Security questionnaire questions you paste are sent to our AI provider with DeBough's observations to draft answers, and not stored by us.
- Files checked with our file checker are examined in your browser and never uploaded. Only a fingerprint (hash) is looked up against public malware databases, and if you ask for an explanation, the file's name and the check results are sent to our AI provider.
3. How we use it
- To run the Service: show results, send the alerts, weekly summaries, and lessons you ask for, and guide fixes.
- To keep the Service reliable and protect it from abuse.
- To process payments and communicate with you about your account.
- To improve DeBough. We don't sell your data or use it for advertising.
4. Who helps us (service providers)
We use a small number of providers to run DeBough. They process data only to provide their service to us:
- Vercel hosts the website and dashboard.
- Supabase stores account and dashboard data and handles sign-in.
- Resend delivers our emails.
- Anthropic provides the AI behind explanations, walkthroughs, and drafts. Its commercial terms say data sent through its API isn't used to train its models.
- Stripe processes payments.
- Have I Been Pwned tells us which addresses at a domain you've verified appear in known data breaches. We send it only the domain name.
We also look up public information about domains and software (for example DNS, domain registries, and CISA's list of actively exploited vulnerabilities). Those lookups share only the domain or product name, never information about you.
We may disclose information if the law requires it, or to protect the rights and safety of users or the public.
6. How long we keep it
We keep your data while your account is active so you can see history and trends. When you disconnect a computer, it stops sending data. If you ask us to delete your account, we delete its data within 30 days, except records we must keep for legal, tax, or billing reasons. Backups roll over on their own schedule.
7. Security
Data is encrypted in transit. Each company can only see its own data. Device tokens, enrollment codes, and lesson links are stored only as one-way hashes. You can turn on two-step sign-in for your account. No system is perfectly secure, so please tell us through our contact page if you find a problem.
8. Your choices and rights
- You can see and change most of your data in the dashboard, disconnect computers, remove people and domains, and unsubscribe from emails.
- You can ask us for a copy of your data, to correct it, or to delete it. Depending on where you live (for example California), you may have additional rights; we honor them and won't treat you differently for using them.
- Staff who received lessons can ask their employer, or us, to remove their details.
9. Children
DeBough is for businesses and adults. It isn't meant for anyone under 18, and we don't knowingly collect their data.
10. Where data is processed
DeBough is run from the United States, and our providers may process data in the United States and other countries.
11. Changes and contact
We'll update this page if our practices change and tell account owners about significant changes. Questions or requests? Use our contact page.