Privacy Policy

1. Two kinds of data, two different rules

[PLACEHOLDER — REQUIRES LEGAL REVIEW] This policy treats two categories of data differently, because they have different legal bases and different retention needs:

• Data about our users— an account's Terms/Acceptable-Use acceptance record (timestamp and version agreed to), and, if a scan is ever submitted while signed in, the requester's IP address tied to that submission. This is personal data about you, and is what a "delete my account and data" request removes.
• Data about scanned third-party domains — the scan results themselves (TLS configuration, response headers, DNS records, publicly visible software identifiers) describe the public-facing posture of a domain, not personal data about the person who requested the scan. This data is not deleted by any individual requester's account-deletion request, since it belongs to — and may be relied on by — anyone who has scanned or looked up that domain.

2. What we collect

• The domain you submit for scanning, and the resulting scan report.
• The IP address and timestamp of each scan submission, and your attestation that you own or are authorized to assess the target domain — kept as an audit trail in case a scanned domain's owner ever disputes being scanned.
• If you sign in for account-tied actions (domain-ownership verification): your Clerk account ID, and your Terms of Service / Acceptable Use Policy acceptance record.

3. Data retention

Scan records and the IP/consent audit trail above are kept for 12 months by default, after which a scheduled job deletes them automatically. Terms/Acceptable-Use acceptance records are kept for as long as the associated account exists, since proof of what you agreed to needs to survive as long as the account does.

4. Your rights

[PLACEHOLDER — REQUIRES LEGAL REVIEW] You can request deletion of your own account data (your consent/acceptance records — see the distinction in section 1) at any time. As of this version, that is available as an API action for signed-in accounts; a dedicated in-product control has not shipped yet — contact us in the meantime via the report form on /about-this-scanner.

5. Cookies

[PLACEHOLDER — REQUIRES LEGAL REVIEW] We use a small number of strictly necessary and functional cookies/local storage entries (e.g. remembering that you dismissed the cookie notice). We do not currently use third-party advertising or tracking cookies.

6. Changes to this policy

[PLACEHOLDER — REQUIRES LEGAL REVIEW] We may update this policy from time to time. Material changes will be reflected in the version and effective date shown at the top of this page.