DRAFT, pending owner approval. Not legal advice. Placeholders in [brackets] must be completed and the text reviewed (ideally by a lawyer) before launch.

Privacy Policy

Last updated: [date]

[Company legal name] ("we") operates SniffPup. This policy explains what we collect and why.

What we collect

• Email address: to deliver your report, sign you in, send alerts and, with your consent, product tips.
• Submitted URLs and scan results: findings are stored with secrets masked; we never store full secret values. For deep checks we store only whether a table or bucket is readable and its row count, never row contents.
• Technical data: IP address (for rate limiting and abuse prevention), and basic server logs.
• Billing data: processed by Stripe; we store your Stripe customer and subscription IDs, not card numbers.

Service providers

Vercel (hosting), Neon (database), Stripe (payments), Resend (email delivery), ActiveCampaign (email list and marketing). Each processes data on our behalf.

Marketing email

When you run a scan or create an account, we use your email to deliver your report, sign-in links and account alerts. We only send marketing email (security tips and product news) if you tick the separate, unticked-by-default “Send me vibe-coder security tips” box; we record that choice and when you made it. Every marketing email includes an unsubscribe link, and you can unsubscribe anytime.

Retention

Scan results: [12 months]. Accounts: until you delete them. Rate-limit records: short-lived.

Your rights

You can request access, correction or deletion of your data by emailing [privacy email]. [Add GDPR/CCPA specifics as applicable.]

Contact

[privacy email], [address]