Privacy notice

Draft for review before public launch. Last updated 12 October 2026.

What we collect

When you request a call we collect your email address, and the domain or repository you were looking at if you provided one. When you run a scan we process the domain or repository you submitted. For security and abuse prevention we also record basic technical information such as the time of the request, your IP address and your browser user agent.

Why we collect it

To run the scan you asked for, to respond to your enquiry, and to protect the service from abuse. We rely on your consent for the enquiry, which you give when you submit the form, and on our legitimate interests for security logging.

Scan reports

New account-linked scan reports are private to their account. Sharing requires an explicit expiring link that the owner can revoke. Existing report links retain their original access until their current expiry. Reports are retained according to the scan route and plan, then expire automatically. Anonymous public scans last 24 hours; signed-in public repository scans last one day on Free, one year on Team and three years on Enterprise. Reports include file paths and matched source excerpts. Full repository archives are processed in memory rather than saved, including during staged scans. Staged scan checkpoints contain findings, coverage and call-graph metadata for up to one hour. Review reports before sharing. Deleting a new account-owned report revokes access first, then removes its stored report and feedback. Downloaded copies cannot be recalled.

How we store it

Submissions and reports use Cloudflare Workers and Workers KV. Account permissions, share links, scan progress and remediation records use Cloudflare D1. Access-management audit metadata is retained for 180 days and contains no source excerpts or share tokens. This deployment does not establish Singapore-only data residency. We keep personal data only as long as needed for the purposes above.

Who we share it with

We do not sell your data. We share it only with service providers who help us run the service, and only where the same standard of protection applies.

Your choices

You can ask us to show you the personal data we hold about you, to correct it, or to delete it, and you can withdraw consent at any time. Contact our data protection contact to do so.

Contact

Data protection contact: to be appointed before public launch.

This notice is provided under the Personal Data Protection Act 2012. It is a starting draft and should be reviewed by a qualified adviser before you rely on it.