Privacy Policy

Last updated 14 October 2026

SafeCheck is built to keep as little data as possible. We don't have user accounts, we don't use tracking or advertising cookies, and we don't store scan results.

What we process when you scan

• Websites: the address you enter. We fetch the public page and its scripts, the same way a browser would.
• GitHub repos: the repository name. Public repos are read anonymously. For private repos you install our GitHub App with read-only access; a signed cookie in your browser remembers which installation you connected for up to 8 hours. We don't store your GitHub token or your code.
• Android apps: the file is unpacked in your browser. Only short strings that look like keys or addresses are sent to us to check.

Any secret we find is shown to you in shortened form and is never saved. Scans run in memory and are discarded when the report is sent.

Payments

Payments are handled by Stripe, which receives your card details, email and billing country. We never see your full card number. The scan target is stored with the payment so we can show you the paid report again.

Logs

Our hosting provider (Vercel) keeps short-lived technical logs, such as IP addresses and error messages, for security and debugging. We use your IP address in memory only to limit how many scans can be run per minute.

Your rights

You can ask what data we hold about you, or ask us to delete it, by writing to support@safecheck.dev. If you are in the EU you can also complain to your data protection authority.