Privacy policy

[Operator legal name], [Operator postal address], is responsible for your data. Contact: [support email].

• Your email address and, with GitHub sign-in, your GitHub login.
• Scan results: findings, masked snippets of 5 lines or fewer, dependencies, scores and reports. Never full source files.
• Notes you add to findings and data-room documents.
• On Pro, the logo and company name you add for your share pages.
• For share links: the viewer's email if you ask for it, and a daily-salted hash of the viewer's IP address. Never the raw IP address.
• Payment status from our payment provider. We never see card numbers.

• Supabase (database and sign-in) and Vercel (hosting).
• Anthropic, for the paid AI report only: a size-limited digest of the repo with secrets masked. Anthropic does not train on API data.
• Stripe for payments, and Resend for email.
• The buyers you send a share link to.

Scan progress lines: 30 days. Everything else: until you delete the repo or your account in Settings. Deletes are immediate.

You can see, export or delete your data. Delete it in Settings, or write to [support email] for anything else.

Proofpack uses only the cookies it needs: your sign-in session, a short-lived GitHub connection check, and a cookie that remembers a buyer passed a share-link gate. No tracking or ad cookies.