Effective Date: March 6, 2026
Sima Technologies LLC (“Company”, “we”, “us”, or “our”) operates GreyPhish at greyphish.com. This Privacy Policy describes how we collect, use, and protect your personal information when you use our service.
When you register, we collect your username, email address, and a hashed password. We do not store plaintext passwords.
Payment processing is handled by Stripe. We do not store credit card numbers or full payment details on our servers. Stripe may collect information as described in their privacy policy.
We collect basic usage information such as pages visited, API calls made, feature usage, and session duration to improve the service.
We automatically collect IP addresses, browser type, device information, and access timestamps for security and operational purposes.
We measure how the site is used with our own analytics, running on our servers. No analytics company receives your visit, and the measurement stores nothing on your device — no cookies, no local storage.
We record the page, its title, where the visit came from (the referring site’s domain, or a tag on a link we posted), how long the page was visible, clicks to other sites, and a few named actions such as starting a signup. We also record a country, a browser name, an operating system and whether the device is a phone, tablet or desktop.
Your IP address and full browser identifier are not stored. They are used, at the moment of the visit, to derive a country and a short code that distinguishes one visitor from another, and are then discarded. That code is rebuilt from a secret we hold separately and changes every day, so it cannot be used to follow you from one day to the next. If you are signed in, your existing session is used to link your visits across your own devices, under a code derived the same way. Nothing in this data identifies a person without that secret, which we keep apart from it.
We never record the query string of a page you visit, so anything carried in a link — a search you typed, a token in an email link — is not part of this data. Analytics records are deleted after 13 months.
We do not sell your personal information. We may share data with:
We retain account data for as long as your account is active. After account deletion, we may retain certain data for up to 90 days for legal and operational purposes, after which it is permanently deleted.
We implement reasonable technical and organizational measures to protect your data, including encryption in transit (TLS), hashed passwords, and access controls. No system is 100% secure, and we cannot guarantee absolute security.
Depending on your jurisdiction, you may have the right to:
To exercise any of these rights, contact us at admin@greyphish.com.
We use essential cookies for authentication and session management. We do not use third-party advertising cookies.
Our own site analytics sets no cookie and stores nothing on your device. For signed-in users it reads the session cookie you already have, so that visits from your own devices can be counted as one person rather than several; see Site Analytics above.
GreyPhish is not intended for users under 18. We do not knowingly collect data from children.
We may update this Privacy Policy from time to time. We will notify active subscribers of material changes via email. The “Effective Date” at the top reflects the latest revision.
For privacy-related inquiries, contact us at admin@greyphish.com.
Sima Technologies LLC