What we collect, and what we don't.

• There are no accounts, and we don't keep a database of scans.
• We don't use analytics, ad trackers, or cookies of our own.
• If you join the email list or buy the full report, we keep your email address with our email provider, Resend.
• Payments go through Stripe. We never see your card number.
• We don't sell or rent your information to anyone.

You give us a URL and, if you like, a public GitHub repo. Our server then makes a small number of read-only GET requests to that site: the homepage, up to 4 of its own JavaScript files, up to 2 source maps, /.env, /.env.local, /.git/config, /robots.txt, and /sitemap.xml. It also checks whether the plain HTTP address redirects to HTTPS. Requests identify themselves as HackOrBroke. We don't log in, submit forms, guess passwords, or read your database.

If you add a repo, we download its public code from GitHub once and read it in memory. It is not saved, and it is gone when the scan ends. Private repos aren't supported.

The results are sent back to your browser. They live in the report link (the part after the #) and in your browser's session storage. Secret values we find are redacted before the report leaves our server. We don't keep a copy, so anyone who should see a report needs the link from you.

To limit abuse, we briefly keep your IP address and the time of each request in server memory (up to 10 minutes for scans and checkout, up to an hour for email signups). It is never written to disk and is cleared when the server restarts.

The “Get notified” form sends your email address to Resend, which stores it on our subscriber list. New addresses get one welcome email. After that, we only email the list about HackOrBroke itself, starting with a note when monitoring ships.

To be removed from the list, email hackorbroke@gmail.com and we'll delete you.

Checkout happens on Stripe's own page. Stripe collects your card and billing details and works out any tax. We never see or store your card number. Stripe tells us your email address, the amount, and whether the payment went through.

The URL you scanned (and the repo, if you added one) is saved with your Stripe checkout session so your report link keeps working. We email you a receipt with that link through Resend and add your address to the same subscriber list. Stripe sends its own payment receipt as well.

Your report link reruns the scan whenever it is opened, and anyone who has the link can open it. Share it only with people you want to see the report.

• Vercel hosts the site. Like any host, it keeps standard request logs, such as IP address, page requested, and time, under its own retention rules. Our code logs errors without your email address or the URL you scanned.
• Resend stores the email list and sends our emails.
• Stripe processes payments and keeps payment records.
• GitHub serves the public repo download when you add a repo.

• Scan results and repo code: not kept after the scan finishes.
• Rate-limit entries: minutes to an hour, in memory only.
• Your email address: until you ask us to remove it.
• Payment records: kept by Stripe for as long as payment and tax rules require.

You can ask what we hold about you, ask us to correct it, or ask us to delete it. Email hackorbroke@gmail.com and we'll handle it by hand. We may need to keep payment records that the law requires.

If this policy changes, we'll update this page and its date. HackOrBroke is run by an independent developer. Questions go to hackorbroke@gmail.com.