Privacy Policy
Last updated 12 September 2026
What we collect
- Account data — your GitHub username, display name, email address, and avatar URL, received when you sign in with GitHub.
- Usage data — the domains you scan, when you scanned them, and the results produced.
- Abuse-prevention data — a random identifier stored in a cookie, and a one-way hash of your IP address. We keep the hash, not the address itself, and use both solely to enforce free-tier limits.
- Billing data — a Stripe customer reference and your subscription status. Card numbers go directly to Stripe and never reach our servers.
- Analytics — aggregate page-view counts via Vercel Analytics, which does not use cookies and does not track individuals across sites.
What we do not collect
We do not sell personal data, run advertising trackers, or share your scan history with anyone. We do not use your scan data to build a product for other customers.
Why we are allowed to hold it
We process account and usage data to perform the contract you enter when you use the service. We process abuse-prevention data on the basis of our legitimate interest in keeping a free tier from being drained. Where the law requires consent, we ask for it.
Processors we use
- Vercel — hosting and analytics
- Neon — database hosting
- Stripe — payments and subscription billing
- GitHub — authentication
Scans query public data sources (crt.sh, CertSpotter, AlienVault OTX). Those requests contain the domain being searched, never your identity.
How long we keep it
Scan results are kept while your account exists so change detection has something to compare against. Anonymous scan records are deleted after 90 days. Delete your account and we remove your personal data and scan history, except records we must retain for tax or accounting purposes.
Your rights
Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to object to certain processing. Email privacy@apexdrift.org and we will respond within 30 days. You may also complain to your local data protection authority.
Cookies
We set two: a session cookie when you sign in, and an anonymous identifier used to count free scans. Both are strictly necessary for the service to function. We set no advertising or cross-site tracking cookies.