Last updated: draft, not yet published.
When you create an account, we collect the email address and password (or GitHub OAuth identity) you sign up with. When you add a target, we collect the repository name or site URL and, for repos, a GitHub access token scoped to reading that repository. When a scan runs, we store the findings it produces — file paths, line numbers, and the AI-generated explanation of each issue. If you upgrade to a paid plan, PayPal handles your payment details directly; we never see or store your card or bank information ourselves.
We use this data to run the scans you request, verify you own each target before scanning it, generate the plain-English explanations and fixes in your reports, send you transactional email (scan results, billing receipts), and operate the free-tier abuse checks described in our Terms of Service. We do not sell your data, and we do not use your scanned source code or findings to train any model.
Running the Service means sending data to: Supabase (database and authentication), OpenAI (the OpenAI API, to analyze and explain scan findings — only the specific finding being explained is sent, not your full repository), GitHub (OAuth and repository access for repos you add), Resend (transactional email), and PayPal (payment processing for paid plans). Each processes data under its own terms and privacy policy. We send only what each integration needs to function.
The marketing pages use Google Analytics and the Meta Pixel to understand where visitors come from and measure signups. Both set third-party cookies and are loaded only on the pages you can reach without logging in. We also log first-party, aggregate page-view counts on our own servers for traffic reporting; that log never leaves our infrastructure and isn't shared with anyone. You can block third-party cookies in your browser without losing access to any feature of the product.
We retain your targets, scan history, and findings for as long as your account is active, so you can track security posture over time. You can delete a target — and the scans and findings tied to it — at any time from the dashboard. If you delete your account, we will delete or anonymize your data within a reasonable period, except where we're required to retain it (for example, billing records).
You can access, export, or delete your targets and scan history directly from the dashboard at any time. To request a full copy or deletion of your account data, or to ask us anything about how your data is handled, contact us at the address below — we'll respond within a reasonable time.
Data is encrypted in transit (HTTPS) and at rest in our database provider. GitHub access tokens are scoped to the minimum permission needed to clone and read a repository. Each scan runs inside an isolated, network-restricted container that is destroyed as soon as the scan finishes, along with the cloned copy of your code.
The Service is not directed at children, and we don't knowingly collect data from anyone under 16. If you believe a child has provided us data, contact us and we'll remove it.
We may update this policy as the product changes. Material changes will be reflected by updating the date at the top of this page.
For questions about this policy, or to make a data request, contact tech@qivalabs.com.