Privacy Policy

1. Introduction

Secrets Watch ("we", "us", or "our") operates the Secrets Watch web application. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our Service.

2. Information We Collect

We collect the following categories of personal information:

Account Information:

• Email address (used for account registration and magic link authentication)

Usage Data:

• URLs and domains you submit for scanning
• Scan results and security findings
• Session data for authentication

Technical Data:

• IP address (used for rate limiting and abuse prevention)
• Browser user agent and cookies (session management only)

3. How We Use Your Information

We use collected information for the following purposes:

• To provide and operate the Service
• To authenticate your account via magic link emails
• To process and report scan results
• To send email notifications about scan results and account activity
• To prevent abuse and enforce rate limits
• To maintain the security and integrity of the Service

4. Legal Basis for Processing

Under GDPR, we process your personal data on the following legal bases:

• Contract performance: Processing necessary to provide the Service you requested
• Legitimate interests: Rate limiting and security measures to protect the Service
• Consent: Where you have provided explicit consent for specific processing activities

Under CCPA, we collect and use personal information for the business purposes described above.

5. Data Storage and Security

All data is stored on self-hosted infrastructure. We do not use third-party cloud providers, external analytics services, or third-party data processors.

Storage systems:

• PostgreSQL database for structured data (accounts, domains, scans, findings)
• Redis for session management, job queues, and rate limiting

Security measures:

• All data in transit is encrypted via TLS
• Passwords are never stored — we use magic link (token-based) authentication
• Access to infrastructure is restricted and authenticated
• Session tokens are hashed before storage

Despite these measures, no system is completely secure. We cannot guarantee absolute security of your data.

6. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Service. Specifically:

• Account data: Retained until account deletion
• Scan results and findings: Retained until account deletion or manual removal
• Session data: Expires after the session timeout period
• Login tokens: Deleted after use or expiration
• Rate limiting data: Automatically purged after the rate limit window expires

Upon account deletion, we will remove your personal data from our systems within 30 days.

7. Third-Party Sharing

We do NOT share your personal information with any third parties. We do NOT:

• Sell your personal data
• Share your data with advertisers
• Use third-party analytics or tracking services
• Transfer your data to external data processors

All infrastructure is self-hosted and under our direct control.

8. Cookies

The Service uses only essential cookies for session management. We do not use tracking cookies, analytics cookies, or advertising cookies. The session cookie is necessary for the Service to function and does not require consent under GDPR.

9. Your Rights

GDPR Rights (EU/EEA users):

You have the right to:

• Access your personal data
• Correct inaccurate personal data
• Request deletion of your personal data
• Object to processing of your personal data
• Request data portability
• Withdraw consent at any time
• Lodge a complaint with a supervisory authority

CCPA Rights (California residents):

You have the right to:

• Know what personal information we collect
• Request deletion of your personal information
• Opt out of the sale of personal information (we do not sell your data)
• Not be discriminated against for exercising your rights

To exercise any of these rights, contact us at: [email protected]

10. Data Breach Notification

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify affected users within 72 hours via email to the address associated with your account.

11. Children's Privacy

The Service is not intended for children under 16 years of age. We do not knowingly collect personal information from children under 16. If we discover that we have collected data from a child under 16, we will delete it promptly.

12. International Users

The Service is operated from our self-hosted infrastructure. If you access the Service from outside our jurisdiction, please be aware that your data will be processed on our servers. By using the Service, you consent to this transfer.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated effective date. We will make reasonable efforts to notify users of material changes via email or a notice within the Service.

14. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights, contact us at: [email protected]