Privacy

Who is responsible

Thomas Kanze, Costa Rica, operator of Preflight (preflightbot.com). Contact: support@preflightbot.com. We try to follow Costa Rica's data protection law (Law 8968) and the EU GDPR.

What we collect

• Scan list: your email, the app URL you may enter, which form you used, your country (from our network provider), a shortened one-way hash of your IP address to stop abuse, and how you found us (see Attribution).
• Accounts: your email, sign-in tokens and session ids (both stored hashed), the domains you add and whether they are verified.
• Ownership check: your verified domain, the Supabase project reference, a one-way hash of the public anon key, and a record of your consent. Kept 7 days.
• Test logins: for a Proof run, two test-account emails and passwords, and the Supabase project URL and public anon key. The passwords are used for that run and are not stored. We keep the project reference and a hash of the anon key for 7 days for the ownership check. Never a service-role key.
• Scan results: findings about your app: counts, table names, policy text, masked secrets, header values, redacted requests and responses. Not the contents of your users' rows.
• Purchases: order and subscription status from Creem. We do not receive your full card details.
• Support email: what you send to support@preflightbot.com.

How test logins are handled

• Held for the Proof run, then discarded. Not written to the database or to logs.
• Used only for the checks you agreed to on that run: the cross-user read, the marked canary write and its cleanup, the privilege-field change and restore, the database-function calls, the storage file, and the AI-function calls.
• A later run asks for them again. Use throwaway accounts.

Why we use it

To tell you once when the free scan opens (your consent, given by joining the list). To provide what you ask for (contract). To protect the service from abuse and to see which channels work (legitimate interest). We do not sell personal data and do not use it for advertising.

Attribution

If you arrive from a campaign link (utm_ tags) or another website, we keep those tags and the referring page address in your browser's local storage and send them with your sign-up. We attach them to your account, apps, scans and purchases to learn which channels bring people who find Preflight useful. Not used for advertising profiles, not shared.

Who handles it

• Cloudflare: hosting, database, email routing, cookieless visit counts (Web Analytics) and sending sign-in emails.
• Piqo: cookieless visit counts on the public site.
• Creem: merchant of record for payments, tax and invoices.
• Google (Gmail): mail to support@preflightbot.com is forwarded to the operator's mailbox.
• Resend (only if enabled as our fallback sender): sending sign-in and report emails.

These providers may handle data outside your country, including in the United States. Where the law requires it, transfers rely on the provider's standard contractual clauses or equivalent safeguards.

How long we keep it

• Scan list: until you ask us to delete it. We review the list at least once a year and delete entries older than 12 months after the free scan opened.
• Accounts: until you ask us to delete them. We review accounts at least once a year and delete accounts with no sign-in for 24 months.
• Reports: 90 days after the scan, then deleted automatically. You can delete one sooner.
• Page content and code fetched during a scan: deleted when the scan finishes.
• Ownership-check records: 7 days.
• Attribution: with the record it belongs to.
• Purchase records: as long as tax law requires.

Your rights

You can ask to see, correct, delete or export your data, or withdraw consent, by emailing support@preflightbot.com. You may also complain to your data protection authority (in Costa Rica, PRODHAB).

Cookies

One strictly necessary session cookie when you sign in, and one local-storage entry for the attribution tags above. No analytics or advertising cookies. Cloudflare Web Analytics and Piqo count visits without cookies and build no profile of you.

If something goes wrong

If a breach affects your personal data or test logins, we email you without undue delay, and within 72 hours of learning of it where the law requires, with what happened and what to do (for example, change your test-account passwords). We notify PRODHAB and other authorities where the law requires.

Published statistics

We may publish anonymous, aggregate scan statistics. They never include domain names or per-site details.