Privacy
Have a lawyer review this page before you rely on it. It describes what this version of the product actually does.
What we collect
When you run a check, we store the public address, the grade, and a redacted report. We do not store the secret keys themselves, the contents of a database row, or the body of a private file. If you type an email, we store it so we can send the report. If you sign in, we store that email and a session. If you pay, Stripe stores the card. We store the Stripe customer id and the plan, not the card number.
Rate limits
We keep a hash of your IP address for about an hour so one person cannot run endless checks. We do not put the raw IP address in the report.
Who we share it with
Email goes out through the provider you configure, Resend by default. Payments go through Stripe. The database is the Postgres database you connect. We do not sell personal information. A shareable scorecard shows the grade and the counts, not the finding details, unless someone has the private link.
How long we keep it
Reports stay until you delete the saved app or ask us to remove them. Sign-in links expire in one hour. Private report links expire in 14 days. You can stop emails by canceling the plan or removing the app.
Cookies
We use a cookie to keep you signed in, and another to remember that you are allowed to see a report you just ran or unlocked. They are not used for advertising.