Privacy notice

• Your email address. To send you a sign-in link and your report. Required for an account; optional for an audit, where it is only used to tell you the report is ready.
• Your name, if you give us one. Shown in the account menu. Entirely optional and never used for anything else.
• The address you asked us to audit, and the report we produced. Including the pages we read, the findings, the score, and the log of every request we made and the answer we got. This is the product; deleting it deletes your report.
• Payment records. Stripe processes the payment and holds the card details. We never see or store a card number. We keep the record that a payment happened, which tax law requires us to.
• Your IP address, briefly. Sent to Cloudflare Turnstile when a form is submitted, to tell a person from a script. We do not keep it alongside your account.

A code audit of a private repository needs a GitHub access token. That token is never written to our database, and never appears in a log. It stays in your browser until the payment completes, is handed straight to the process that clones the repository, and exists only in that process’s memory. When the scan ends it is gone.

The repository contents are held only while the scan runs, and are deleted afterwards. What survives is the report: the findings, and the exact lines they quote.

Four processors, each doing one job:

• Anthropic. Writes the explanation and the fix prompt for a finding. It receives the relevant part of your page or code and the engine’s findings. Anthropic does not train models on this data.
• Cloudflare. Runs the site, the database and the queue, and provides the bot check on our forms.
• Stripe. Takes the payment. Card details go to Stripe and never to us.
• Resend. Sends the emails: your sign-in link, and your report.

We do not sell anything to anybody, and there is no advertising network, no analytics broker and no data sale in this product. Some of these processors operate outside the EEA, under the European Commission’s standard contractual clauses.

Running an audit you paid for and sending you the report is performance of a contract. Keeping the service working, stopping abuse and defending against fraud is our legitimate interest. Keeping payment records is a legal obligation. Where we ever ask for consent, you can withdraw it, and we will say so at the time.

Your account and its reports stay until you delete them. Removing an audit hides it from your account immediately and it is erased within 30 days. Delete your account and everything except the payment records goes with it; those we keep for as long as Greek tax law requires.

Sign-in links expire in 20 minutes and stop working the moment they are used. Share links do the same. A downloaded repository is deleted after the scan.

One cookie, set when you sign in, which holds a signed record of who you are and expires after 30 days. There is no analytics cookie, no advertising cookie and no third-party tracker on this site, which is why you have not been asked to accept anything.

You can ask for a copy of everything we hold about you, ask us to correct it, ask us to delete it, object to our processing it, or ask for it in a portable form. Email us and we will do it within 30 days, without asking why.

If we get it wrong, you can complain to the Hellenic Data Protection Authority, or to the supervisory authority where you live.

When you audit a website, we request a limited number of its public pages, identify ourselves in the user agent, and never execute its JavaScript or attempt to sign in anywhere. If the site is not yours, the terms make that your responsibility.