What we collect
- Account: email address; name and avatar if you sign in with Google or GitHub; a password hash if you set a password.
- Sites and scans: URLs you submit, scan results and evidence (secrets are redacted).
- Security data: IP addresses as one-way hashes, used for rate limiting and an audit log of sign-ins and important account actions.
How we use it
To run scans, show your reports, sign you in, send emails you request (sign-in links and alerts), prevent abuse and improve our checks. We do not use your data for advertising profiles.
How long we keep it
Account data is kept while your account exists. Deleting a site deletes its scans. Anonymous scan reports may be removed after 90 days. Sign-in links expire after 15 minutes.
Your rights
You can ask for a copy of your data, a correction, or deletion of your account by emailing [email protected]. Depending on where you live (for example under the GDPR or Vietnam's Decree 13/2023), you may have further rights, including the right to complain to a data protection authority.
Changes
We will post updates here and change the date above. Material changes will be announced on the site.