Privacy Policy

DRAFT, needs legal review. Not in force. Placeholders in [brackets] must be filled in. Written for a US audience; if the business is based in the EU/DACH, GDPR and local rules (e.g. an Impressum) apply and this must be adapted.

Last updated: [date]. Controller: [legal entity name, address, email].

What we collect

Email address	For free scans: to deliver the teaser and (only if you tick the box) the newsletter. For paid checks: from Stripe Checkout, to send your report and receipt.
Newsletter opt-in	Only when you tick the free-scan checkbox. Off by default. We store the consent text and the time. Unsubscribe any time.
Repository URL	To run the check.
IP address (hashed)	For free-scan rate limits only. We store a salted hash, not the raw IP.
Payment	Handled by Stripe. We never see your full card number.
Repository contents	Cloned temporarily for the check and deleted right after the report is generated.
Report	Kept for [30] days so we can resend it or handle support, then deleted. [Confirm retention.]
Newsletter	Only if you tick the free-scan opt-in or use the footer form. Unsubscribe any time.

Who we share it with

Stripe: payments.
Anthropic (Claude API): excerpts of your repository's code and scanner results are sent for the AI review. [Check and link Anthropic's current commercial data-use terms.]
[Email provider]: sending your report.
[Hosting provider]: running the service.
GitHub: we query GitHub's public API about the repository.

We don't sell personal information and don't use your code to train models.

Secrets in your code

If our scanners find keys or passwords, the report shows them only partially masked. Raw values are not stored.

Your rights

You can ask us to access or delete your data at hello@leakcade.com. [Add GDPR/CCPA wording depending on where the business is based.]

Cookies