Privacy Policy
Last updated: October 20, 2026
What we collect
- Free scans: the repo or site URL you enter, the score and findings, and scan metadata (time, file counts). To prevent abuse we rate-limit by IP address and store only a hashed visitor ID, never your raw IP.
- Email: if you give it to unlock results, join the waitlist, or buy, we keep your email to send your score or report and related updates.
- Purchases: your email, the repo or site you enter, and payment status. Payments are processed by Stripe; we never see or store your full card number.
- Source code: we copy a repository temporarily to scan it and delete the copy when the scan ends. We never store your code. Reports contain file names, line numbers and findings, with any secrets masked.
- GitHub App: if you install it, we get read-only access to the code and metadata of the repos you select, plus the installation ID. Each scan uses a short-lived token limited to that repo, which is revoked when the scan ends. Uninstall any time in GitHub settings.
- Leaderboard and badges: only if you opt in: the repo name, score, date, and the handle and tool you choose to show.
How we use it
To run scans, deliver reports and Monitoring alerts, handle purchases and refunds, prevent abuse, and improve the service. We don't sell your data, use it for advertising, or train AI on your code.
Cookies and analytics
We use Vercel Web Analytics to count page views and clicks (for example, clicks on a checkout link). It doesn't use advertising cookies or track you across sites. We set only short-lived functional cookies needed for sign-in flows such as connecting GitHub.
Service providers
Stripe (payments), Vercel (hosting and analytics), Resend (email) and GitHub (repository access) process data on our behalf, under their own privacy terms.
Retention and deletion
Code copies are deleted after each scan. Reports, scan metadata and purchase records are kept so you can track progress and so we can re-deliver reports and handle refunds. Email support@cheqvo.com to access or delete your data.
Leaked secrets
If your report shows exposed keys, rotate them right away. We show where a secret is, not its full value.