Privacy policy

Who we are

Securick is run by the operator of Securick (details on our contact page). We decide how your personal data is used (we're the "controller" under the GDPR and UK GDPR). Questions or requests: support@securick.com.

What we collect, and why

• Scans. The address you scan and what the scan found. Secrets we find are masked before they're stored, and we never store rows from your database. Why: to run the scan you asked for and show you the report (contract, GDPR Art. 6(1)(b)).
• Your IP address, in memory, to limit how many free scans and sign-in attempts one visitor can make. Our audit log keeps only a keyed hash of it, not the address. Why: to keep the service safe from abuse (legitimate interests, Art. 6(1)(f)).
• Your account, if you make one: your email address, your password (only as a scrypt hash, never the password itself), your signed-in devices (a label like "Chrome on Mac", from your browser), your scans and projects, and your Pro pass. If you sign in with Google, we get your Google account id and email address from Google, nothing else (no name, photo or contacts), and keep the id to recognise you next time. Why: to give you the account (contract).
• Connections you choose to make: for GitHub, which installation and repository you connected (we read your code in memory to check it and keep only the findings); for Supabase, an encrypted refresh token so scheduled checks can run; for the MCP server, your API keys (stored only as a hash). Why: contract.
• Payments. Polar sells the Pro pass as merchant of record and handles your card details; we never see them. We receive the order number and which product you bought, linked to your account. Why: contract, and keeping records the law requires.
• Messages you send us through the contact form: your name, email address and message, so we can reply. Why: your request (legitimate interests, Art. 6(1)(f)). Kept 365 days.
• The Pro waitlist, if you join it: your email address, used once to tell you Pro is open. Why: your request (consent, Art. 6(1)(a)); you can ask us to remove it at any time.

The Chrome extension

If you use the Securick extension, it sends us only the address of the page you choose to scan, when you click Scan (or pick "Scan with Securick" from the right-click menu). It doesn't read the pages you visit, your browsing history or anything you type. In your browser it keeps the key that connects it to your account and the id of your last scan per site; Disconnect (or uninstalling it) removes them, and you can revoke the key under API keys on your account page. Why: to run the scans you ask for (contract).

Cookies

We use only cookies the site needs to work, so we don't ask for consent (ePrivacy Directive Art. 5(3)): lp_session keeps you signed in (30 days, renewed while you use it), lp_scans remembers the scans you ran in this browser so they can join your account when you sign in, and lp_admin is for our own admin page. While you sign in with Google, lp_google (15 minutes) makes sure the sign-in finishes in the browser that started it. We don't use analytics, advertising or tracking cookies, and we don't load third-party trackers.

Who processes data for us

• Hosting: our hosting provider.
• Payments: Polar (merchant of record for the Pro pass).
• Google, when you choose Sign in with Google (your Google account id and email address).

Some of these companies are in the United States. We use them under their data processing terms, which include the EU Standard Contractual Clauses (and the UK addendum) for transfers outside the EEA and UK.

How long we keep it

• Scans you didn't save to a project: 90 days (paid single reports: 365 days).
• Scans in a project: until you delete the project or your account.
• Your account: until you delete it (Account → Delete account). That removes your scans, projects, connections, keys and passes straight away.
• Expired sign-ins and used email links: deleted within a day. Audit log: 365 days. Contact messages: 365 days. Waitlist: until we've emailed you, then 30 days.
• Payment records: kept by Polar and by us for as long as tax law requires.

Your rights

You can ask to see, correct, delete or export your data, object to our use of it, or restrict it (GDPR Art. 15–21). Most of it you can change or delete yourself on your account page; for anything else write to support@securick.com and we'll answer within one month. You can also complain to your data protection authority (in the UK, the ICO).

California residents: we don't sell or share personal information, and we don't use it for targeted advertising.

Children

Securick is for people building and running websites. It isn't meant for children under 16, and we don't knowingly collect their data.

Security

Data travels over HTTPS only; passwords are hashed with scrypt; session ids, sign-in links and API keys are stored only as hashes; the Supabase token is encrypted (AES-256-GCM). Found a security problem? See security.txt.

Changes

If we change this policy in a way that matters, we'll say so on this page and, if you have an account, by email before it takes effect.