Our own house.
A service that reads what businesses publish about their email should pass its own test, hold as little as possible, and say plainly how to report a problem. This page is that.
Our own domain
bondstone.app publishes SPF, DKIM and an enforced DMARC policy (p=quarantine), read from public DNS 1 November 2026. Read it again yourself with the commands shown on this page.
What each record does, and how to read your own: SPF, DKIM and DMARC in plain English.
What we hold about you, and for how long
As little as the job needs. The privacy policy is the full statement; this is the short one.
- The count form: your firm's website and your email, used to count your area and reply to you, and for nothing else.
- A pack: your own domain's records, read once before delivery so you can see what a recipient sees. Nothing from your mailbox, ever; you send from it, we never touch it.
- The do-not-contact list: the businesses and people who have asked not to be contacted, kept for as long as they should not be, which is indefinitely.
- Deletion: write to sales@bondstone.app and it is done within a working day, with a reply saying so.
What we do not hold
- No passwords for anybody's systems. Nothing is logged into, anywhere.
- No scan results, because nothing is scanned. The whole method is published.
- No copy of your mailbox, your sent items or your replies. They are yours and they stay on your side.
- No card numbers. You pay by card on Stripe's own page, and the card is taken by Stripe, never by us.
Reporting a problem
If you find something wrong with our systems, our records or a pack, tell us. We answer within one working day and we say what we did about it.
A finding about a business that turns out to be wrong is a security problem by our standard, and it is fixed the same way: withdrawn, replaced two for one, and the change dated.
Check us the way we check everybody
Every record on this page is public. Run the same lookups from any terminal, and check your own domain the same way.