Privacy

SafetyScan stores the URL you submit, the public HTTP/DNS evidence we collect, a random scan id, and (if you send a report) the recipient address. If you sign in we store your email and plan. Payments go through Stripe (customer id, not card numbers). Scan pages are unlisted (not indexed) but anyone with the link can open them. An unlocked report is fully visible to anyone with that link — that is the point of a webmaster packet.

A random visitor cookie and recent IP addresses are stored for up to 14 days to enforce the free-preview quota (including VPN hopping). They are not written into the scan report. We do not sell data. Email is sent through the SMTP server configured on this instance.

Do not paste secrets into the URL field. If an exposed .env is detected we store redacted key names, not values. You can delete your account from Dashboard → Settings. That removes the login and unlinks your scans; existing unlisted report links stay reachable.