DevMeth — Privacy Policy

This policy explains what DevMeth collects, why, and how long we keep it. The short version: we store the minimum needed to run a scan and send you results; we delete your scanned code after a scan by default; and we never store full secrets, unredacted evidence, or raw request bodies.

1. What we store

• Email address (when you provide it) — used to send you your report link and, if you buy, a receipt, plus the occasional product update (every one has an unsubscribe link). It may be shared with our email provider (Resend) to deliver those messages. We never sell or share it.
• Scan metadata — the checks run, their status/skip reasons, and a stack fingerprint (framework, data layer, deploy hints). This powers the report and re-scans.
• Masked evidence — findings include locations and a masked sample (prefix + last 4 of a secret, or a redacted snippet). Full values are never stored.
• Payment/order info — processed by Stripe; we store the Stripe session/charge identifiers needed to settle and refund, never your card details.

2. What we never store

• Full secrets or credentials found during a scan (only masked samples).
• Raw HTTP response bodies or full file contents from live probing.
• Raw IP addresses — where we rate-limit by IP, we store only a hash.
• Your database password or connection secrets.

3. Deletion and retention

Scanned code is deleted after a scan by default. The only exception is if you opt into retention to enable re-scans until green (Launch Pack): that copy is AES-256-GCM encrypted and automatically purged 30 days after your scan. You can delete your code and report at any time via the "delete my scan" control on your report page.

4. Cookies and analytics

We use Plausible, a privacy-friendly analytics service that does not use cookies and does not collect or store personal data, only aggregate counts and page views. We do not sell your data.

5. Legal bases (GDPR/CCPA)

Where GDPR or CCPA applies, our lawful bases are: performance of a contract (providing the scan), legitimate interest (fraud/abuse prevention and product improvement), and consent where we ask for it. You have the right to access, correct, export, or delete your personal data.

6. Your rights and how to exercise them

To export or delete your data, use the "delete my scan" control on your report or email nick@devmeth.com and we will respond within 30 days. We never sell or share your personal data with third parties except the processors named above (Stripe, Resend) to provide the Service.

7. Contact

Privacy questions: nick@devmeth.com. See also the Acceptable Use Policy and our scan bot policy.