Privacy
Last updated 25 October 2026.
We collect as little as we can.
Safe scans
We store the URL, your authorization confirmation, and results so the report link works.
Orders
Name, email, target URL, plan, verification token/status, notes, payment references from Stripe.
Payments
Handled by Stripe on its checkout page. We never see your card or bank details. For subscriptions we keep the Stripe customer and subscription references so renewals and cancellations are recorded.
Security Care monitoring
For subscribers we keep the domain verification, the results of each scheduled scan of your site, and a log of the alerts and monthly reports we email you. We only email the address you subscribed with, only about your own site, and never for marketing.
Code security review (optional)
If you connect a GitHub repository, we store your token encrypted (AES-256-GCM) on our server, use it only to read that repository, and delete it when a one-off review finishes (Security Care: when you disconnect or cancel). We keep a temporary copy of the commit we review only until the review ends. To review it, the text of the selected files (with secret-looking values removed first) is sent to Anthropic's Claude and OpenAI's Codex through their command-line tools; it is not sent to any other AI service. We keep the findings for your report, not your code.
IP addresses and country
IP addresses are used only for in-memory rate limits (up to one hour); never written to disk. Cloudflare tells us which country a visit comes from; we use that to show prices in your currency and in our anonymous visit totals (see below), never linked to you. If you open a currency preview link (one ending in ?cc=), we set a one-day cookie that only remembers that preview country.
Help chat
If you use the help chat's "talk to a human" form, we store the email address and question you enter so we can reply to you. We also store the text of questions the chat couldn't answer, so we can improve its answers. The help chat is processed on our own server, and we don't share these messages with anyone.
Visit counts
Per day by source. A small script of our own also tells our server which page is open while the tab is visible, so we can see how many people are on the site right now: the page, the referring website's domain, browser, device type, operating system, screen size and language, plus the country from Cloudflare. It uses a random ID kept in the tab's session storage, which is gone when you close the tab. To count unique visitors per day, your IP address is turned into a one-way code with a key that changes every day; the IP address itself is never stored. We keep only daily totals. If your browser sends Do Not Track or Global Privacy Control, we only count the page view, with no details. No cookies, no profiles, no third-party analytics.