Privacy policy
This policy explains how Derek W. Miller's DWM Command website handles Google sign-in, membership and IT-tool information. Questions or requests: derek@derekwmiller.com.
Google sign-in
Sign-in requests basic OpenID Connect identity permissions: openid, email and profile. Google provides an account identifier, verified email address and basic profile information, such as your name. The site uses these to identify you, check approved membership and maintain your signed-in session. This sign-in does not request access to Gmail messages, Google Drive files, calendars or contacts. The site does not receive your Google password.
Membership and session information
The member directory stores an approved email address, active/disabled status, a Google account identifier bound at first approved sign-in, membership version, creation time and last successful sign-in time. It also records membership-management events and daily IP-lookup attempt counts. The owner can view and manage these records. Daily usage records have no queried IP attached and older usage days are removed when another lookup attempt is reserved.
A secure, HTTP-only session cookie maintains sign-in and protects requests. Session information can include your account identifier, email, name and access state. Signing out clears the browser session cookie. Session cookies are signed for integrity; they should not be treated as encrypted storage.
Browser-only utilities
Tools identified as local process pasted text in your browser. Their tool input is not intentionally saved in browser storage by these tools. Some features explicitly send information to this server, as described below. Copying a report places that report on your device clipboard.
IP Investigation
The public IP you enter is sent to this server and then to ipapi.is to obtain location estimates, network ownership, proxy/VPN/hosting and abuse indicators. The provider receives the queried IP and the server's network request, not your Google identity as an application field. The investigation endpoint does not intentionally store queried IPs or returned reports. Account usage counts and short-lived rate-limit state are maintained separately.
Email Investigation and mail DNS
Full email source or an uploaded .eml submitted to Email/Barracuda Investigation is transmitted to this server and parsed in memory. The investigation application does not intentionally save or log the submitted message contents or report. It does not send the full message to Google or ipapi.is, execute message HTML, visit extracted links or scan attachments for malware.
Optional independent DKIM verification sends the signature's public DNS lookup names to Google Public DNS. Mail DNS lookup sends its domain, selector and optional sending IP fields to this server; relevant public DNS names are queried through Google Public DNS. Mail DNS results and their input fields can be cached in server memory for about two minutes. Google and ipapi.is handle requests under their own policies.
Other site features and operational records
Public posts and associated media are published intentionally. Administrative features may store post drafts, revisions and AI Labs test prompts, outputs and results. This is separate from the non-persistent investigation endpoints. Hosting, reverse-proxy and application systems may process or retain operational metadata, such as visitor IP addresses, request paths, timestamps, browser information, status codes and errors. Infrastructure logs and backups can have different retention from live application data.
Use, sharing and protection
Information is used to provide tools, authenticate accounts, manage access, limit abuse, troubleshoot service problems and maintain the site. Google sign-in identity information is not sold, used for advertising, or supplied to IP/DNS providers as part of tool queries. Service providers process the information necessary for their functions. Information may also be disclosed where required by law or necessary to address security incidents. Transport encryption, restricted administration and request controls help protect data, but no service can guarantee absolute security.
Retention and your choices
Membership records and membership-change history have no automatic expiry in the current application. Disabling membership stops restricted-tool access but does not delete records. To request access, correction or deletion, contact the owner using the address above. The owner reviews requests and removes information where appropriate, subject to operational, security and legal needs. Removed information may remain in existing backups until those backups are replaced or expire; no fixed backup-erasure period is promised here.
You can sign out, clear site cookies and revoke DWM Command access in your Google Account's third-party connections settings. Revoking Google consent does not itself delete the site's membership records. Submit only information you are authorized to analyze and remove unnecessary personal or confidential details.
External resources and changes
Google sign-in and DNS services, ipapi.is and externally loaded fonts or other resources can receive ordinary request metadata when used. Linked services have their own privacy practices. This policy may be updated as the site changes; the date above identifies this version.