Septimius - Privacy Policy
Last updated: October 19, 2026

Septimius is a Firefox extension that warns you about phishing websites. This policy explains, in plain language, what it stores, what it sends, and to whom.

What stays on your device
- Your settings (sensitivity, notification and warning choices, protected domain names).
- The list of sites you chose to trust (exact site names only, up to 500).
- Counters of how many warnings you have had, per day (no addresses), kept for 90 days.
- Your last 50 warnings: the site name, the warning level, the reason and the time.
- Short-lived "continue anyway" permissions: a site name and an expiry time (10 minutes).
- The text of the pages you visit is read on your device to look for scam phrases. It is never stored or sent anywhere.
You can erase all of this by removing the extension.

What Septimius sends automatically
- When you open a web page, the site name (for example example.com, not the full address) is sent to the Septimius server, which says whether it is on the threat list.
- If you switch on "Look up domain age automatically" in Options (it is off by default), the site name is also sent for an age lookup.
- Not sent: the page's text, form contents, passwords, cookies, or your search terms. The path and query part of an address are not sent by these automatic checks.

What Septimius sends only when you click
- Domain age: the site name goes to the Septimius server, which asks the domain's registry (RDAP) or, if you chose it in Options, WhoisFreaks.
- VirusTotal: the full address of the page goes to the Septimius server, which asks VirusTotal. A full address can contain private details (for example a reset link). Please do not use this button on such pages.
- AbuseIPDB: only the IP address you type in.
- Report phishing: the full address of the page is sent to the Septimius server and emailed to the developer so the site can be reviewed and, if confirmed, added to the threat list.

Who else receives data
Only through the Septimius server, and only for the features above: domain registries (RDAP), WhoisFreaks, VirusTotal, AbuseIPDB, and an email service used to deliver reports. The Septimius server runs on a hosting service, and the threat list is stored in a hosted database.

What the server keeps
- The threat list (site names from public feeds and confirmed reports).
- The server does not save the sites you check.
- A report is emailed to the developer with the page address and the time. The server does not keep it. Reports are deleted from the developer's inbox within 90 days of being reviewed. The email service keeps its own sending history.
- Like any web host, the hosting service may keep technical request logs for a short time.

What Septimius does not do
No account. No advertising. No selling or sharing of your data with advertisers. No tracking of you across sites. No building a history of the sites you visit.

Your choices
You can switch off the full-page warning, notifications and automatic domain-age lookups in Options. The threat-list check is how the extension works, so to stop it, remove the extension.

Changes
If this policy changes, the new version will be shown here and the date above will change.

Contact
septimius.support@gmail.com