Legal
Privacy Policy
Last updated: October 18, 2026
The short version
- We collect only what we need to check and fix your app, and to bill and support you.
- We never read or store the contents of your database rows, and we never ask for your secret keys.
- We don't sell your data or share it for advertising. Our site has no cookies, analytics or trackers.
- Email [email protected] to see, correct or delete your information.
This policy explains how Vibe Pit Crew ("we", "us") handles personal information. It follows the principles of Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). It's part of our Terms of Service.
1. Who is responsible
Vibe Pit Crew, a business based in Ontario, Canada, is responsible for the personal information described here. Our privacy contact handles questions and requests at [email protected].
2. What we collect
When you request a free check
- What you type in: your app's URL, your email address, your GitHub repo link (optional), what you built the app with, and your confirmation that you own or are authorized to test the app.
- What we record automatically: the date and time, a reference number, the country your request came from (as reported by our hosting provider), and your browser's user-agent string.
- A hashed IP address. We don't store your IP address. We combine it with a secret value and run it through a one-way hash, then keep a shortened version. We use it only to limit abuse of the form. Short-lived rate-limit counters, keyed by that hash and by a hash of your email, expire automatically within 2 days.
When we scan your app
- Passive check results: what we found in your app's public pages, JavaScript and headers, such as the type of any exposed key and where it appears. We don't keep full key values.
- Verified check results: table and bucket names, whether each one is open, and row counts. We never read or store row contents.
- Ownership records: which method you used to verify (meta tag, file or DNS record), when, and the result.
When you buy a Lockdown Fix or re-scans
- Repo access: through our GitHub App, installed on the one repo you choose, with permission to read and write code and pull requests and to read basic repo details. We don't ask for administration, workflow or secrets permissions. We copy your code into a temporary private workspace to build the fix.
- Database structure: table definitions, policies and permissions, from your repo or from audit output you choose to send us. Not your data.
- Test-account logins, if you give us two throwaway accounts for the read-only re-check.
- Order details from our payment provider: your name, email, country, what you bought, the amount and a transaction ID. We never see your full card number.
- Job records: findings, test results, the pull request we opened and our emails with you.
When you email us
Your email address, your message and anything you attach. Please don't send secret keys or passwords. If you do, we delete them and ask you to rotate them.
What we don't collect
- No cookies, analytics, ad pixels or trackers on our website, and no third-party scripts. Our only script runs the free-check form.
- No contents of your database rows, and no secret key values.
3. Why we use it
- To reply to your free-check request and send your results.
- To confirm you own the app before any deeper check, and to keep a record that we only tested with permission.
- To build, test and deliver your fix, re-check it, and run re-scans you subscribe to.
- To bill you, issue refunds, and keep the records tax law requires.
- To answer support questions, prevent abuse of the form and keep our services secure.
- To send you marketing emails, such as news about re-scans, only where anti-spam law allows it. Every marketing email has a one-click unsubscribe link, and we act on it within 10 business days, usually the same day.
We don't use your information for anything else without asking you first. By submitting the form or ordering, you consent to these uses. You can withdraw your consent at any time (section 7), though we may then be unable to provide the service.
4. Who we share it with
We don't sell, rent or trade your personal information, and we don't share it for advertising. We share it only with the service providers below, only as much as they need to run our services, and under their own privacy and security commitments. We may also disclose information if the law requires it.
| Provider | What they do for us | What they handle |
|---|---|---|
| Cloudflare | Hosts our website and form, stores free-check requests (Cloudflare D1 database), runs rate limiting, and routes and sends our email | Form fields, hashed IP, country, user-agent, email content |
| Our payment provider: Paddle or Stripe | Checkout, payments, receipts, tax and refunds. If you check out through Paddle, Paddle is the seller of record and handles your payment details under its own privacy notice. If you check out through Stripe, Stripe processes the payment for us under its own privacy policy. | Name, email, billing country, payment details, order history |
| Proton | Our email inbox, where form notifications and your emails to [email protected] arrive | Email addresses, messages, free-check request details |
| GitHub | Runs our GitHub App, which gives us access to the repo you choose, and hosts the pull request we open | Your repo, GitHub username, the pull request |
| Our AI model provider | Runs the AI agents that analyze your code and write the fix | Code excerpts, database structure and findings. Never row data or secret key values. We use a provider whose terms don't allow it to train on our requests. |
These providers may store or process information outside Canada, including in the United States, the European Union and Switzerland. While it's there, it's subject to the laws of those places, and authorities there may be able to access it.
5. How long we keep it
| Information | How long |
|---|---|
| Free-check requests (URL, email, repo link, built-with, confirmation, country) | 12 months after our last contact with you, then deleted |
| Hashed IP address and user-agent | 90 days, then removed from the request record. Rate-limit counters expire within 2 days. |
| Scan results | 12 months, or while your re-scan subscription is active plus 90 days |
| Ownership and authorization records | 3 years after your last check or job, so we can show we only tested with permission |
| Our copy of your code | Deleted within 3 business days of your job closing. Kept only while a re-scan subscription is active. |
| Test-account logins | Encrypted while the job is open, and deleted when it closes |
| Orders, invoices and refunds | 6 years after the end of the tax year they relate to, as Canadian tax law requires |
| Support emails | 2 years after the conversation ends |
| Unsubscribe list | Your email address only, kept for as long as we send email, so we don't email you again by mistake |
When we delete information, we delete it from our systems. Copies in our providers' backups expire on their normal schedules.
6. How we protect it
- Data is encrypted in transit, and access to our systems is limited to the agents and accounts that need it.
- We store a hashed IP, not your IP address.
- Repo access is limited to one repo, and we remove it when the job ends.
- Your fix is built on a local copy. We never connect to your production database except for read-only checks after you've proven ownership.
- If a breach of our safeguards creates a real risk of significant harm to you, we'll notify you and the Office of the Privacy Commissioner of Canada as the law requires.
7. Your choices and rights
You can ask us to:
- see the personal information we hold about you and how we've used and shared it;
- correct anything that's wrong;
- delete your information, except records we must keep by law, such as tax records; or
- stop marketing emails, or withdraw your consent to other uses.
Email [email protected] with the subject "Privacy request", from the email address you used with us, so we can confirm it's you. Requests are free. We respond within 30 days, and tell you if we need more time and why.
If you're not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada.
8. Children
Our services are for app owners and businesses, not children. We don't knowingly collect information from anyone under 18.
9. Changes to this policy
If we change this policy, we'll update the "Last updated" date. If a change affects how we use information we already have, we'll email the people affected before it takes effect.
10. Contact
Vibe Pit Crew, privacy contactEmail: [email protected]