Privacy policy

When you register and use the service, this deployment stores: your name and email address; a scrypt hash of your password (never the password itself); your email-verification status; the workspaces and projects you create; which team members belong to which workspace; notifications addressed to you; and an audit trail of actions taken in the workspace (who did what — no IP address is recorded in audit events).

When you sign in, a session record is created containing a hashed session token, your browser's user-agent string, and your IP address when the deployment runs behind a trusted proxy that provides it (otherwise the IP is recorded as unknown). Session records stop working after 30 days.

If you subscribe to a paid plan, Stripe billing identifiers (customer and subscription IDs) are stored. Card numbers and payment details are handled by Stripe and never reach this deployment's database.

Project configuration you enter: target URLs, repository and bundle paths, the email addresses of test identities you configure, and the names of environment variables that hold your credentials — never the secret values themselves. Scan configuration and results are stored: check outcomes, findings with evidence that has been redacted before storage, and report share links you create (revocable at any time in the app).

To scan a target, the scanner running on this deployment contacts the URLs you configured, and identifies itself with a plain user-agent string. The command-line tool runs checks entirely on your machine and sends nothing to this deployment.

No advertising, no cross-site tracking, no data sale, no third-party analytics scripts, and no third-party fonts: your browser makes no third-party requests while using this service. There is no data-sharing-for-consideration of any kind.

All storage below is first-party; none of it is used for advertising or tracking:

• lg_session — essential sign-in session cookie (30 days).
• lg_ws — preference cookie remembering which workspace you last viewed (1 year). The service works without it.
• lg_policy_ack — records that you accepted the current terms and privacy policy versions (180 days).
• localStorage — your light/dark theme preference only.

The service sends transactional email: address verification, password resets, welcome messages and scan notifications. To deliver them, your email address and the message are passed to the email provider this deployment is configured with (the operator's own SMTP server or their email-delivery provider). Members are never emailed on your behalf; adding a member only looks up an email address of an existing account.

Honestly stated: sessions stop working after 30 days; API tokens and report share links can be revoked in the app (revocation is kept as a record, not erased). Beyond that, this deployment does not run automatic purge jobs — scan history and account records are kept until you ask for deletion. To request a copy of your data, a correction, or deletion of your account and data, write to [[CONTACT EMAIL]]. Requests are handled by the operator; there is no automated self-service deletion today, and you will receive a plain answer about what was done.

This service is not directed at children and is not offered to anyone under [[AGE REQUIREMENT]]. If an account is found to belong to someone younger, it will be removed; write to [[CONTACT EMAIL]].

Material changes are announced on this page with a new version number and date, and signed-in users are asked to review and accept the new version before continuing.

This policy and the terms of service are governed by [[GOVERNING LAW AND JURISDICTION]]. The operator's contact address is [[CONTACT EMAIL]][[POSTAL ADDRESS IF REQUIRED]].