Privacy

What we collect

When you scan a URL, we fetch the public page, its same-origin scripts, and a short list of common files such as /.env and source maps. We store the URL, the score, and the findings. If a secret matches, we store the key type, an 8-character prefix, and a SHA-256 hash. We do not store the raw secret, the HTML, or the JavaScript.

We store the IP address only in memory, to rate-limit free scans (5 per IP per day on a single server). We do not write a scan log of IPs to disk.

If you join the waitlist, we store the email address, which list you asked for, and the time. If Resend is configured, we send one confirmation.

What we do not do

The free scan does not call your Supabase project. It does not read rows, count rows, or sign in. We do not sell data. We do not train models on your code or secrets. If an LLM key is set, the model receives finding titles, severities, categories, and key prefixes. It does not receive secret values, page HTML, or database rows.

How long we keep it

Scan reports are deleted after 30 days. On Vercel Hobby the file store is local to one instance and can disappear sooner. Waitlist emails stay until you email privacy@readytolaunch.cc and ask us to delete them.

Subprocessors

Vercel hosts the app. Resend sends email when RESEND_API_KEY is set. Vercel AI Gateway writes the plain-English pass when AI_GATEWAY_API_KEY is set. Without those keys, the scan still runs and the copy is templated. Later milestones add our own database, a payment merchant of record, GitHub, and Google PageSpeed. They are not in this release.

Contact

Privacy and deletion: privacy@readytolaunch.cc. Security: security@readytolaunch.cc.