Privacy Policy

What a scan collects

• The URL you submit and the resulting public scan data — certificate, security headers, DNS records, and detected technology.
• Basic request metadata — IP address, timestamp, and browser user-agent — used only for rate-limiting and abuse-prevention.
• If you join the waitlist or buy a scan: your email address, and for payments, billing details handled by our payment processor. We never see or store full card numbers.

How we use it

• To run your scan and deliver the report. For Monitor and paid customers, we store scan history so you can track changes over time.
• To keep the service available and safe — rate-limiting, abuse-prevention, and security.
• Aggregate, anonymised patterns (URL and findings, with no client identity attached) may be retained to improve detection accuracy. We do not sell or share personal data.

How long we keep it

• Reports are deleted after 30 days unless you save them to an account.
• Anonymised scan data (URL + findings, stripped of identity) may be kept longer to improve detection.
• Email and billing records are kept while your account is active, or as long as tax and accounting rules require.

Cookies

We use only essential cookies — session, security, and abuse-prevention cookies set by Cloudflare. No advertising or cross-site tracking cookies.

Third parties we use

Cloudflare (hosting / CDN / abuse protection), Anthropic / Claude (paid report generation only), and — for paid tiers — Lemon Squeezy (payments) and Resend (transactional email). Each receives only the data needed to provide its part of the service.

Your choices

You can request a copy of your data, ask us to delete it, or unsubscribe from emails at any time — email [email protected] and we'll action it.