Privacy Policy
Last updated: 2026
What we collect
- The URL you submit and your email address (if provided).
- Scan results and findings, including redacted evidence of issues.
- For the Deep Check: the Supabase anon key, the list of tables to test, and the two test-account credentials you provide, plus a record of your consent.
- Basic request metadata (such as IP) used for rate limiting and abuse prevention.
How we use it
We use this information solely to run your scans, generate and deliver your report, provide support, and operate the Service. Payment is handled by Stripe; we do not store your card details. Report emails are sent via Resend.
How we store and protect it
Scan data and Deep Check inputs are stored in our database and are accessed only by our server using privileged credentials — never exposed to the browser. We do not harvest end-user PII from your application beyond what is needed to demonstrate a specific finding.
Secrets and test accounts
Treat any credential shared with us as needing rotation after remediation. We recommend using dedicated, low-privilege test accounts for the Deep Check and rotating their passwords once your fixes are confirmed.
Data retention
We retain scan results and reports so you can access them later and use your included rescan. You may request deletion of your scans, reports, and Deep Check inputs at any time by contacting us.
Third parties
We rely on infrastructure providers to operate the Service, including Supabase (database), Stripe (payments), Resend (email), Trigger.dev (job execution), and Vercel (hosting). We are not affiliated with these companies.
Contact
For privacy requests, reply to any email from the Service or use the contact address on our site.
This page is operational guidance, not legal advice.