Privacy Policy

Last updated: July 2026

1. Information We Collect

When you use SecurityScanner, we collect the following information:

  • Account information: Email address, name, and OAuth provider data (Google) when you sign up.
  • Scan targets: URLs you submit for security scanning. These are processed to generate security reports and are not shared with third parties.
  • Usage data: Scan frequency, feature usage, and quota consumption for billing and service improvement.
  • Technical data: Browser type, IP address, and cookies for authentication and analytics.

2. How We Use Your Information

  • To provide and improve our security scanning service
  • To authenticate your account and manage sessions
  • To process payments via Stripe (card data is handled directly by Stripe and never touches our servers)
  • To send service-related notifications (scan completions, security alerts)
  • To enforce rate limits and prevent abuse

3. Data Storage & Security

Your data is stored in Supabase (hosted on AWS) with row-level security policies. We use encryption in transit (TLS 1.3) and at rest. Service role keys are stored as environment variables and never exposed to the client.

4. Third-Party Services

  • Supabase: Database hosting
  • Stripe: Payment processing (PCI DSS compliant)
  • Anthropic: AI-powered vulnerability triage and code fix generation
  • Vercel: Frontend hosting
  • Fly.io: Backend worker hosting

5. Cookies

We use cookies for: authentication sessions (session tokens), guest identification (ss_guest_id, 30-day expiry), and language preference (locale). No tracking or advertising cookies are used.

6. Data Retention & Deletion

Scan results are retained for the lifetime of your account. You can delete your account and all associated data by contacting us. Guest scan data is automatically purged after 30 days.

7. Your Rights

Depending on your jurisdiction, you may have the right to: access your personal data, request correction or deletion, object to processing, and data portability. Contact us to exercise these rights.

8. Contact

For privacy-related inquiries, please reach out through our support channels.