Terms

1Who we are

Preflight (preflightbot.com) is automated software run by Thomas Kanze, an individual in Costa Rica. Contact: support@preflightbot.com.

You must be 18 or older, and use Preflight for your own app or business.

2What Preflight is

Preflight runs a fixed set of automated checks on a web app you have verified you own, and reports what it found. No person reviews your app. It is not a certification.

Checks can miss real problems and can flag things that are fine. A clean report only means the listed checks found nothing at that moment. Each report lists what was not checked. Webhook and edge-function checks do not run.

You stay responsible for your app. We are not liable for a problem Preflight did not report, or for acting on a finding that turns out to be wrong.

3Only test what you own

Before any scan you prove control of the domain with a DNS TXT record or an HTML meta tag. By starting a scan you confirm, in writing, that you own the app or its owner has authorised the test, and that you created the test accounts you give us.

Unauthorised testing may be a crime where you live and in Costa Rica. Do not use Preflight on systems you are not allowed to test, bypass the ownership check, abuse the service with automation, or build a list of other people's vulnerabilities.

4What the tests do

• Free scan: read-only. GET and HEAD requests only. It writes nothing to your app.
• Proof Report: runs as two test accounts you create, against rows those accounts made. It records counts and table names, never the contents of rows.
• Writes: it inserts one row marked preflight-canary-<scan id> and deletes only that marker. There is no database transaction. If your policies block the delete, at most one marked row stays per table, and the report gives you the one-line DELETE to run. Privilege columns on a test account are changed, then restored by a second request. A crash between the two can leave the change in place, and the report says so.
• Database functions: it calls the database functions (RPCs) it finds, as test account A with account B's id, and with no sign-in when a function takes no arguments. Names that look state-changing (delete, send, charge, reset and similar) are skipped and listed. If a function has side effects, those side effects happen.
• Storage: it uploads one small storage file marked preflight-canary-<scan id> and deletes it by that marker when your policies allow. It overwrites an existing file only if its name matches the marker. Otherwise the report lists it.
• AI functions: at most two database functions whose names look like AI or credit-spend calls. They can spend credits if the function debits them.
• Secrets found in public code are masked in reports and kept out of our logs.

Before a Proof run you prove you control the Supabase project by creating a small function with SQL we generate. The proof lasts 24 hours and covers one run.

Never give us service-role keys, admin credentials or real customer accounts, and do not use Preflight on apps that handle health data or other special categories of personal data. The full test list is on How it works.

5We can say no

We may refuse, pause or stop a scan, or suspend an account, if we believe it is unauthorised, abusive, harmful to someone else or unlawful. We may help law enforcement and the owners of systems that were tested without permission, including by sharing account and verification records where the law allows.

6Suggested fixes

Reports include suggested SQL, settings and prompts for AI tools. They are suggestions made without knowing your whole system. Back up your data and test a change before it goes to production. We are not liable for the result of applying one.

7If you scan what you should not

If you scan a system you were not authorised to test, or break these terms, you agree to cover the reasonable losses and legal costs we suffer as a result, to the extent the law allows.

8Accounts

You sign in with a one-time email link. Do not share it. You are responsible for what happens in your account.

9Payments

Paid products are sold by Creem, our merchant of record. Creem takes your payment, handles sales tax and issues receipts, and its buyer terms also apply. Prices are in US dollars before any tax.

10Monitor subscriptions

Monitor renews each month or year until you cancel. Cancel anytime from the billing portal in your account or your receipt. It ends at the end of the period you paid for, and you keep access until then. We email you at least 30 days before a price change takes effect. Founding prices ($12/mo or $120/yr, for subscriptions started on or before 20 November 2026) stay the same while you stay subscribed. No partial refunds for unused time, except where the law requires them.

11Refunds

• Not satisfied: a full refund on request within 14 days of your first purchase of any paid product (Proof Report, Launch Pack, or your first Monitor payment).
• Monitor renewals: no refunds for past periods after those 14 days, except where the law requires them.
• EU, EEA and UK: you normally have 14 days to withdraw from digital services. At checkout you ask for delivery to start now and accept that this right ends once the paid scan begins. The 14-day refund above still applies.
• Failed runs: if a Proof run fails before it finishes because of an error on our side, we request a refund of that purchase from Creem. If the payment reference is missing, we handle the request by hand. A finding is a result, not a failed run.

To ask, email support@preflightbot.com. We reply within 3 business days. Details: Refunds & cancellation.

12What each product includes

• Proof Report: one app, with the checks in section 4 as two test accounts you create. Up to 20 re-scans within 30 days of purchase.
• Launch Pack: software only, up to 3 apps, re-scans for 90 days, $79.
• Monitor: weekly re-scans of up to 3 apps. Checks that need test accounts need you to enter the test logins again, because we don't store them.

Reports are kept 90 days after the scan, then deleted. A report link needs the account that ran the scan.

13Reports and licence

Your reports are yours to use and share. The software, check definitions and report format stay ours. We may publish anonymised, aggregate statistics, never your domain or findings.

14Liability

Preflight is provided "as is". To the extent the law allows, we are not liable for indirect or lost-profit losses, and our total liability for any claim is limited to the greater of what you paid us in the 12 months before the claim and USD 100. Nothing here limits liability that the law does not allow us to limit, including your mandatory consumer rights.

15Changes

We give at least 14 days' notice of material changes, by email or on this page, unless the law requires a change sooner. You can stop using Preflight anytime and ask us to delete your account.

16Law

These terms are governed by the laws of Costa Rica, without prejudice to the mandatory consumer protections of the country where you live.