Privacy policy
Version 3 · Last updated
We collect as little as we can. We never store your source code or your website's content, and we don't use advertising or tracking cookies.
Who is responsible
Ironleaf Technologies, Dubai, United Arab Emirates, which runs Afterprompt, is responsible for your personal data. Contact: security@afterprompt.io.
What we collect
| Data | When | Why | How long |
|---|---|---|---|
| Website address you submit (host and path, without the query string) | Free scan | Run and show the scan | 90 days |
| Scan results: issue type, location and a short excerpt with secrets masked | Every scan | Show the report | 90 days |
| GitHub account id, username and primary verified email, if you sign in with GitHub | Sign-in | Your account, receipts and alerts | Until you delete your account |
| Your email address, if you sign in with email | Sign-in | Your account, receipts and alerts | Until you delete your account |
| The email address you type to get a sign-in code, and hashes of the code and link we email (never the code or link) | Sign-in by email | Send you the code and check it once | 1 day |
| Your Google account’s verified email address, if you sign in with Google (nothing else from Google) | Sign-in | Your account, receipts and alerts | Until you delete your account |
| A hash of your session token (not the token) | Sign-in | Keep you signed in | 30 days at most |
| Subscription status and your customer id at Stripe | Purchase | Give you the plan you paid for | Until you delete your account |
| Repository id and name (GitHub), or your GitLab address, project path and id and, for self-hosted GitLab, its public signing keys; site addresses, Supabase URL and public anon key, Firebase project id | When you connect them | Run code scans and backend checks | Until you remove them or delete your account |
| Names of database tables and API routes found by code scans (never the code) | Code scans | Target backend checks of your verified site | Until you remove the project or delete your account |
| Names and versions of the packages your lockfiles pin, and the ids of advisories already reported (never the code) | Code scans of pushes | Pro: email you when a new vulnerability is published for one of them | Until you remove the project or delete your account |
| Per repository and month: its numeric id, whether it is private, and how many scans and AI reviews it used | Code scans | Apply the plan’s monthly limits | 13 months |
| Your email address and the plan you want, if you join the waitlist for paid plans | Waitlist | Write to you once, when the plan opens | 12 months, or until you ask us to remove it |
| Your email address, if you ask for a free-scan report by email, with the report it’s for, whether you confirmed it and whether you want tips | Free scan, optional | Send you the report link; if you confirm, one reminder to scan again about a week later; tips and product news only if you ticked the box | 12 months, or until you click “delete my address” in any of our emails |
| Source code changed in a commit, sent by our GitHub Action or GitLab CI job | Code scans | Scan it | Not stored: scanned in memory in an isolated sandbox, then discarded |
| Code excerpts (about 25 lines), changed server files (up to 400 lines) and database policies, with secrets masked | Code scans with AI review | Explain findings and suggest fixes | Not stored by us |
| Daily counts of page views, scans and sign-ups, and the hostname of the site that sent you to us | Browsing | Measure what works | 2 years, as counts only |
| A hash of your IP address and browser name, made with a random key that changes every day and is never saved | Browsing | Count unique visitors without cookies | Deleted after 2 days; only the daily count is kept |
| The country of your IP address, looked up on our server in a local database (DB-IP) | Viewing prices | Show prices in your currency (dirhams in the UAE, euros in the euro area, dollars elsewhere) | Not stored: the IP address and the country are dropped once the page is built |
| Hostnames of sites submitted to the free scan, with daily scan counts and the last grade | Free scan | Understand which sites use the scanner | 2 years |
We don't store the IP addresses of people who run scans: rate limits use keyed hashes that expire. The only cookies are the session cookie when you sign in, and the currency you pick on the pricing page if you change it (kept for a year).
We use your data to provide the service you asked for, and to understand and improve it (our legitimate interest). When you buy a plan, Stripe processes your card details and billing address under its own privacy policy, and we never see your card.
Who we share it with
| Provider | Purpose | Location |
|---|---|---|
| netcup GmbH | Servers and database | Germany |
| GitHub, Inc. | Sign-in and repository integration | United States |
| Google LLC (OSV.dev) | Pro: looks up package names and versions for new vulnerabilities (no code, no account data) | United States |
| Google LLC | Sign-in with Google, if you choose it | United States |
| Anthropic, PBC | AI review of masked code excerpts (code scans, on every plan) | United States |
| Stripe | Payments, invoices and receipts | United States |
| Resend | Alert emails, sign-in codes and the report emails you ask for | United States |
| Zoho Corporation | Our email inbox, when you write to us | United States |
Anthropic processes AI review requests under its commercial terms, which don’t allow it to train models on them. We never sell your data. When data leaves your country, we rely on our providers' standard contractual clauses or equivalent safeguards.
Backups
Encrypted database backups are kept for 14 days, so data you delete disappears from backups within 14 days.
Your rights
You can download all your data, or delete your account and all its data immediately, from your dashboard. You can also ask us to access, correct, erase or restrict your data, object to its use, or receive a copy, by writing to security@afterprompt.io. We answer within 30 days.
You can also complain to the data protection authority where you live.
Security
How we protect your code and data is described on our security page.
Changes
We'll post changes on this page and email account holders about important ones.