Privacy
This is a draft that counsel has not reviewed. It says in plain words what this website and its software collect, written from the code as it is today. Last updated October 23, 2026.
What we collect
| Where | What | What it is for, and how long |
|---|---|---|
| Your account | Your email address, when the account was made, and your subscription status. | To sign you in and know whether your plan is active. Kept until you delete the account. |
| Sign-in codes | A six-digit code we email you. The server keeps only a keyed hash of it, in memory, never on disk and never in a log. | To check the code you type. It works once and is gone after 10 minutes, five wrong tries, or a restart. |
| Cookies | Signed-in customers get one session cookie named ss_acct (7 days). The owner, after signing in with a passcode, gets ss_session (12 hours). Both are HttpOnly and not readable by page scripts. The server keeps only a hash of each. | To keep you signed in. Signing out or deleting the account ends it. |
| Billing | Stripe's customer id, subscription id and subscription status for your account. Never your card number: Stripe handles payment on its own page. | To know whether your plan is active. Kept until you delete the account. |
| Your code | The files of the repository or zip you connect, and its git history when a zip includes the .git folder. | Only for the scan. It is written to a private temporary folder, read but never run, and deleted after each scan. We keep the GitHub address (or that it was a zip), not the code. |
| Your findings | What each check found and where (file names, line numbers, a masked version of any secret, never the whole secret). | So you can read and fix them. Stored encrypted, readable only by your account. Kept until you remove the app or delete the account. Only counts, such as how many scans ran, are ever seen by anyone else. |
| Your domains | The domain names you add, the proof token, and what the outside look found. | To check the DNS record that proves the site is yours, and to show you the results. Kept until you remove the domain or delete the account. |
| GitHub App | If you connect private repos: the installation number and the GitHub account name it belongs to. | To fetch the repositories you chose, read-only. Access tokens are short-lived and are not stored. |
| The "Ask a person" form on the home page | The name, email, company, code host and message you type, plus the time you sent it and a random id. | So a person can read your request and answer it. It is saved as one line in a file on the server's disk. Nothing deletes it automatically yet, so it stays until a person deletes it. |
| Loading any page | The server's own log keeps the request method, the page path (without anything after a "?"), the status code and the time it took. | To see that the site is working. The log does not hold your IP address, email, cookies, codes, findings or form answers. Our host may keep its own logs; see "Who else is involved". |
| Your IP address | Held in the server's memory only. | To count tries, so sign-in, codes and the request form can be limited. It is never written to disk and is gone when the server restarts or the count ages out. |
| The sample app at /app | Two small settings stored on your own device (st_onboarded and st_org), and an offline page and icons kept by a service worker. | To remember that you have seen the welcome screen and which company you last opened, and to show an offline page. These stay on your device. What you type into the sample company is not sent to us. |
What we do not do
- No ads, no analytics and no tracking scripts.
- We never run your code, and no person reads your findings.
- The home page, this page, the terms page and the account page load nothing from any other website. The sample app at /app does load its fonts from Google Fonts, so Google can see your IP address and browser details when you open it.
- We do not sell what you send us.
- The website sends one kind of email: the sign-in code you ask for. It does not send email about the request form; a person replies from their own mailbox.
Who else is involved
| Who | What they get |
|---|---|
| Railway | Hosts the server and the disk the files are saved on. Railway may keep its own logs of visits, including IP addresses, under its own policies. |
| Stripe | Our payment processor. It receives your email and payment details on its own page, under its own privacy policy. |
| Resend | Sends the sign-in email, so it receives your email address and the code. |
| GitHub | We download the code you connect from GitHub. If you install the GitHub App, GitHub knows that. |
| npm and the Python package index | When the dependency check runs, the names and versions of your packages (from your lockfile, never your code) are sent to their public advisory services to look up known holes. |
The domain name is kept at a registrar. We have not chosen any other service provider that receives your information.
Download or delete everything
On your account page, "Download my data" gives you every record and finding we hold for you as one file. "Delete my account" (after a download) cancels your subscription at Stripe and deletes the account, every app, scan, domain and finding.
Asking us to delete or correct something
To have a request or a finding about you deleted or corrected, contact us: No contact address has been published yet. Until one is, use the request form on the home page and a person will reply.
Changes
When the code collects something new, this page is changed first. The date at the top says when it last changed.