Privacy Policy

This policy explains what FrameScan collects and why. We collect the minimum needed to run scans you ask for and to bill you.

What we store

• Your account — email address and authentication, handled by our identity provider (Supabase).
• Domains & verification — the domains you add and proof-of-ownership tokens.
• Scan reports — the findings for domains you scan: detected software, matched advisories, and remediation guidance.
• Billing — subscription and payment status. Card and payment details are handled entirely by Stripe/PayPal; we never see or store them.

What we deliberately do NOT store

We never store the valuesof any secret we detect. If a scan flags an exposed environment variable or key, the report names it and tells you to rotate it — it does not record the secret itself. A database of customers’ keys would be a catastrophic breach, so we don’t keep one.

How reports are shared

A report is reachable only via its unguessable link. Anyone with the link can view it until you delete it. Deleting a report makes the link stop working.

Bot protection (Cloudflare Turnstile)

To ensure scans are triggered by a real person and not automated abuse, we use Cloudflare Turnstile. In its invisible mode it runs a lightweight check in your browser and may collect certain information (such as a challenge token and browser signals) to distinguish humans from bots. That processing is governed by Cloudflare’s Turnstile Privacy Addendum. Turnstile does not use this data for cross-site tracking or advertising.

Sharing & retention

We do not sell your data. We share only with the processors that run the Service (hosting, identity, payments, and bot protection) as needed to operate it. We keep your data while your account is active; you can delete reports at any time, and closing your account removes your associated data.

Aggregate statistics

Our public stats page shows anonymized, tenant-less totals (e.g. how many scans found a given class of issue) — never your domains, reports, or identity.

This document is a plain-language summary and not legal advice.