Privacy policy
What we collect
- Your email address, for sign-in links and reports.
- The URLs of apps you add, their verification status, and scan results: check statuses, scores, masked secret previews, and deploy fingerprints (hashes of public JS bundles, public route names, client-side env var names, third-party script origins).
- Flow test steps you write and their pass/fail logs.
- Billing records from Stripe (Checkout Session IDs, which pack you bought) and your credit balance and usage history. We never receive or store card numbers.
- IP addresses for rate limiting, kept for up to 24 hours.
What we don't collect
We never store full secret values found on your site, the contents of your pages, or your visitors' data. We don't use advertising trackers.
Processors
Hosting and database (Vercel and Supabase, planned), email delivery (planned provider), and Stripe for payments. Data is processed in the United States.
Retention and deletion
Scan history is kept while your account is active. Delete an app to delete its history, or email us to delete your account and all associated data within 30 days.
Security
Sign-in uses single-use, expiring magic links. Sessions and tokens are stored hashed. Row-level security restricts every record to its owner.
Contact
A privacy contact address will be listed here before launch.