Privacy Policy

What Russell Verify does

Russell Verify checks whether email addresses exist and finds business email addresses from a person's name and company website. Checking an address never sends it an email and never uses that mailbox's password: Russell Verify asks the receiving mail server whether it would accept mail for the address and stops before any message is sent. It never logs in to the mailboxes it checks.

Your account

• Account details: your full name, your email address, when you accepted the terms, when you registered and when you verified your address. They are kept while the account exists.
• Your password is never stored in readable form: only a salted one-way hash (PBKDF2-SHA256) is kept, so nobody, including us, can read it.
• Verification and password-reset links work once and expire (verification after 24 hours, password reset after one hour). Only a one-way hash of each verification link is stored; it is deleted about a week after the link expires.
• Accounts never verified are deleted automatically about 7 days after registration.
• Cookies: every page sets a security (CSRF) cookie that protects its forms. Signing in, and using Bulk Verify or the Email Finder, uses a session cookie that lasts up to two weeks (or until you sign out). Expired session records are deleted automatically. No advertising or tracking cookies are used.
• Account emails (verification links, password resets and security notices) are delivered by our transactional email provider, Postmark, which receives your email address and the message.

Extension access and API usage

• API keys: only a one-way hash of your key is stored, with its label, its first characters (to recognise it), when it was created and last used, and when it was revoked. The full key is shown once, when it is created.
• Extension sessions: for each signed-in extension we keep the name it gives, its browser identification (user agent), when it signed in and was last used, and when it ends. Its access and refresh tokens are stored only as one-way hashes. Session records are deleted 30 days after the session is signed out or expires. You can sign extensions out and revoke your key at any time on your account page.
• Usage: per day, the number of API requests, searches started and requests refused by limits, kept while the account exists, so that limits can be applied and usage reviewed.
• Abuse protection: sign-in, registration and similar attempts are counted for a short time (about one hour at most) under a one-way hash of the IP address or email address involved.

What is stored and for how long

• Email Finder: the names and company websites you enter or upload, the uploaded file, the results (addresses found, their status and evidence links) and the CSV/XLSX downloads are kept for 24 hours, then deleted automatically. Searches made on the website require the browser session that made them; searches made through the extension are visible only to the account that made them. Russell Verify administrators can see accounts and searches to provide support and handle abuse.
• Bulk uploads: the uploaded file, its rows (including the email addresses and any name columns) and the CSV/XLSX downloads are kept in private storage for 24 hours, then deleted automatically. Downloads require the browser session that uploaded the file.
• Public Evidence: company-website searches, the public pages read and the addresses seen on them are kept for 24 hours, then deleted automatically.
• Verification cache: recent mail-server and DNS answers are kept for up to 24 hours so repeated checks are fast and polite to mail servers.
• Verification records: each result (status, confidence and technical SMTP/DNS details) is kept to improve accuracy. It is stored under a one-way hash of the address, not the address itself. If the address was found on the company's public website, the record includes that public page link and text excerpt. These records are not linked to your account.
• Domain statistics: per-domain mail-server information (for example whether a domain accepts every address) is kept to improve accuracy. It contains no personal data.
• Server logs: our web server records each request (IP address, time, page requested and browser identification); these logs are rotated daily and deleted after about two weeks. Application logs record technical events and errors; they are limited in size and overwritten as new entries arrive.

Your choices

To delete your account, email support@russellverify.online from its address: your account details, API keys, extension sessions, usage records and searches are deleted. To have an address removed from Public Evidence results, or a verification record deleted, email the same address. Report abuse to abuse@russellverify.online.