Privacy
The free check
When you submit an address, the server fetches that page, the scripts it links to on the same site, and a handful of public paths (robots.txt, .env, .git/HEAD, source maps). If it finds a Supabase or Firebase project in the scripts, it asks that backend what an anonymous visitor could read, one row at a time with a limit of one, and reports whether tables answer, not what they contain. It never writes anything.
The report is sent back to your browser and discarded. The server keeps one log line per check: a short hash of the host name, the worst severity found, the number of findings, and the builder detected. No addresses, no report contents, no account.
Your connection's address is held in memory to limit checks to a few per hour and is never written to disk.
Paid work
For paid packages you share repository access and the result of a read-only database query you run yourself. Reports and notes are kept for the length of the engagement plus ninety days, then deleted, unless you ask for them to be kept. Credentials are never requested and never stored.
Cookies and analytics
None.