Privacy during the private beta

The free check

You give us an address. We fetch its pages, the script files they name, any source maps it publishes, and, if its code names a Supabase project, that project's public API as a signed-out stranger would reach it. We read only what any visitor could.

Only check apps you own or are allowed to test.

We keep the address and the findings: table and column names, how many rows a stranger could reach, and the first and last few characters and the length of any key we find. We do not keep row values.

The report link stops working after 24 hours, and we delete the result about 48 hours after the check. Trigger.dev, which runs the check, keeps its own record of the address for its own retention period.

To limit how many checks one visitor can run, we keep a keyed hash of your IP address and browser name, changed daily and deleted after two days. Cloudflare Turnstile checks that you are a person, so Cloudflare sees your browser during the check.

Your account

We keep your email address, to sign you in and to send the alerts you turn on. We set the cookies sign-in needs. We use no analytics or advertising trackers, and we do not sell your data.

During the beta you join by invitation. If you are invited, we keep your email on the invite list, with when and why it was added and the account it made. Deleting your account removes that link, and the address stays on the list until we remove it, which we do when you ask.

We record in our own database when you reach a step (signed up, first check, ownership proved, connected, fix applied, Verify pressed, share made), to see where people get stuck. No outside tracker sees it. Your sign-up step is deleted with your account, and the other steps with the organisation that reached them.

Your permission to check

When you start a check we record that you confirmed you own the app or may test it: the sentence you confirmed, the version of our terms, the time, the app's address, and your account and app if you have them. We keep this record for as long as your account exists and for one year after it is deleted. For a free check made without an account, we keep it for one year from the check, even though the result itself is deleted after about 48 hours.

When you connect a database: the Inside check

You create a separate database role by running statements we show you first. Its password is random and sealed, and we never show it back. We read your schema and access rules, and we run each check inside a transaction that is rolled back, so nothing it writes stays. You agree to that in writing before it runs.

We keep:

• Findings, the who-can-do-what grid, counts and data types.
• The database host and project reference you entered, unsealed, so the Connect page can show them again. Only an admin of the app can read them, and deleting the app deletes them.

We do not keep the values in your rows.

When you add a Stripe key: Payments (Stripe)

We accept only a restricted key. We show it to Stripe first, to confirm it can read events and webhook endpoints, and we store it only if it can. We read those two things and nothing else.

The walk-through

This is not running yet. We do not ask for a test user's password, and nothing signs in to your app. We will update this page before it starts.

Proving you own an app

When we ask you to prove you own an app, you publish a code we give you, in a file, a DNS record or a tag in your home page. We fetch it when you ask us to, and keep that you proved it and how.

How secrets are sealed

Passwords and keys are encrypted before they are stored. The website can seal them but cannot open them. Only the separate system that runs your checks holds the key that opens them.

How long we keep things

• Proof attached to a finding: 7 days on the free plan, 30 days on a paid plan.
• A share link: 7 days. Share links exist only for a saved app's reports, never for a free check.
• The record of your permission to check: while your account exists and one year after it is deleted, or one year from a free check made without an account.
• An invite: until we remove it from the list.
• Everything else tied to your account: until you delete it.

Deleting everything

Deleting an app removes it and everything under it: runs, findings, proof, links and sealed secrets. Deleting your account does the same for every app in an organisation only you belong to. If other people share an organisation with you, you leave it and their apps stay. If you are its only owner, we ask you to name a second owner first.

The role you created stays in your database until you drop it.

Who else handles your data

We use these services to run Vediqx. Each one sees only what it needs:

• Supabase holds our database and signs you in: your account, your apps, and the results of your checks.
• Vercel hosts the website and runs its server code.
• Trigger.dev runs checks and scheduled jobs, such as the nightly check of a saved app.
• Resend sends our emails: sign-in links and alerts.
• Cloudflare (Turnstile) checks you are a person when you sign in or start a free check. It sees your browser and connection, not your app.
• Stripe receives your key if you add one.
• Anthropic writes the one-sentence summary on a fix. It receives only the kind of problem, how serious it is, and our own description of what each step of the fix does. It never receives your app's address, the names of your tables, columns or functions, the fix's database statements, any row of your data, any key or password, or your email.

Contact

Vulnerability reports: security@vediqx.com. Everything else, including any request about your data: support@vediqx.com.

Vediqx is operated by Shreyas Reddy Karre, doing business as Vediqx, Massachusetts, United States.