Privacy Policy

StackShield ("we," "us," "our") operates a beta security scanning and remediation service for Supabase, GitHub, and Vercel projects. This Privacy Policy explains what we collect, why we collect it, who we share it with, how long we keep it, and what you can ask us to do with it. It applies to stackshield.org and the StackShield application during the beta program (capped at approximately 100 accounts).

The short version. We collect what we need to run scans and fixes for you, and nothing more. We never sell your data. Your access tokens and BYOK AI key are encrypted at rest, raw code is not stored, scan history is deleted after 30 days, and deleting your account deletes your data immediately. Every third party that touches your data is listed in Section 8.

This policy does not cover data you process in your own applications. StackShield reads configuration and code, not your application's end-user records, and we do not want that data. If you are a customer's end user with a question about an application we scanned, please contact the operator of that application.

1. What we collect and why

Payments. Paid plans are processed by Polar, which acts as merchant of record. Polar collects your billing details and payment method directly and charges your subscription each period; StackShield receives only the subscription status and identifiers needed to activate your plan. When you upgrade or downgrade, Polar issues the resulting prorated invoice or credit note — we do not compute or process that charge ourselves. Invoices, receipts, and related tax records are retained by Polar under their own retention policies (see Section 6).

We do not request or store more access than is needed to perform the scans and fixes you initiate. For Supabase, GitHub, and Vercel we connect exclusively through OAuth and never ask you to paste a personal access token. We also do not use your data for advertising, profiling, or sale.

2. Code and configuration snippets

File contents and configuration snippets are fetched transiently to detect issues and generate proposed fixes, and may be sent to the AI provider you connected under your own BYOK key for analysis. Raw code and configuration content is not stored. What we keep is structured finding metadata — the rule that fired, the file path and line, and a redacted match — which is required for scan history and drift detection.

Scan history for drift detection. To detect new security issues between scans, we store a summary of each scan run (structured findings, severity, timestamps) for up to 30 days, linked to your account. It is automatically deleted after 30 days or when you delete your account. If you opt in to scheduled scans, this same data powers automatic rescans and Telegram drift alerts. To clear your scan history early, disconnect and reconnect the provider.

3. Public instant scanner and public badge

Instant scanner. The no-login scanner accepts a URL, fetches that page's public HTML and response headers, and returns findings without creating an account. The findings are not stored. The URL you submit and your IP address are used to run the scan and to enforce per-IP rate limits, and the IP is retained only for the duration of that rate-limit window.

Security badge. If you enable the shareable badge, the resulting grade is served publicly so it can be embedded on your site. Enable it only if you are comfortable with your security grade being publicly visible. Nothing else about your account is exposed by the badge.

4. Legal bases for processing (EU and UK users)

Where the GDPR or UK GDPR applies, we process personal data on these bases:

• Performance of a contract — creating your account, running scans and fixes, and administering your subscription.
• Legitimate interests — keeping the Service secure, preventing abuse and excessive load, debugging failures, and improving the product. We balance these against your rights and keep the data involved to a minimum.
• Consent — Telegram alerts and optional analytics. You can withdraw consent at any time by unlinking Telegram, declining analytics, or contacting us; withdrawal does not affect processing that already happened.
• Legal obligation — retaining billing and tax records where the law requires it.

5. How long we keep data

• Account data (email, encrypted tokens, BYOK key, MCP key hashes, schedule, Telegram link) — kept while your account exists, then deleted on account deletion.
• Scan history and findings metadata — up to 30 days, then deleted automatically, or immediately on account deletion.
• Rate-limit counters (including IP-based counters for the instant scanner) — kept only for the active rate-limit window.
• Support correspondence — kept while needed to resolve your request and for a reasonable period afterward, then deleted.
• Payment and tax records — held by Polar for as long as accounting and tax law requires; these survive account deletion.
• Operational logs — kept for a limited period for debugging, security, and abuse prevention. They may contain your user ID and request timestamps, and are not linked back to a deleted account's profile.

6. Storage and security

OAuth tokens, API tokens, and your BYOK AI key are stored encrypted at rest with AES-256-GCM and are never stored, logged, or transmitted in plaintext. Data in transit is protected with TLS. Access to production systems that store this data is restricted to what is necessary to operate the Service. MCP API keys are stored only as SHA-256 hashes — the raw key is shown to you once at creation and cannot be recovered afterward.

Scoped access. We hold a short-lived access token and an encrypted refresh token, scoped to the organisation or project you approve at consent time — not account-wide access. Tokens are refreshed server-side and are never sent to your browser. When you disconnect, we attempt to revoke the grant with the provider (where the provider supports programmatic revocation) before deleting our copy.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If you believe your account or a connected token has been compromised, contact us immediately.

7. Security incidents

If we become aware of a personal data breach affecting your account data or connected tokens, we will notify affected users without undue delay by email, and where the GDPR or UK GDPR applies, we will notify the relevant supervisory authority within 72 hours of becoming aware where required. We will describe what happened, what data was involved, and what we are doing about it, and we will take reasonable steps to contain and remediate the issue.

8. Who we share data with

We do not sell your data, and we do not share it for advertising. We share it only with service providers that help us operate the Service, under contracts that limit them to processing it on our instructions, plus the connected providers you direct us to contact. Our current sub-processors are:

When you connect Supabase, GitHub, or Vercel, we exchange data with those providers at your direction so the Service can scan your projects. Polar may use its own payment infrastructure and banking partners to process a charge. We may also disclose data where we are legally required to, where necessary to enforce our Terms, or to protect the rights and safety of StackShield, our users, or the public.

If StackShield is involved in a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction. We will notify you before your data becomes subject to a different privacy policy.

We will update this list if we add or replace a sub-processor, and we will notify active users of material changes by email or in-app notice.

9. International data transfers

StackShield is operated from Kenya, and our providers process data in the United States and on a global network. Your data may therefore be processed in a country other than your own. Where the GDPR or UK GDPR requires it, we rely on appropriate safeguards for those transfers, such as Standard Contractual Clauses or the UK International Data Transfer Addendum. You can ask us for more detail about the safeguards that apply to your data.

10. Your rights

Regardless of where you live, you can ask us to:

• Tell you what personal data we hold about you and give you a copy.
• Correct data that is inaccurate or incomplete.
• Delete your data — or do it yourself instantly in Settings (see Section 5 of these Terms for how account deletion works).
• Export your account data in a portable, machine-readable format.
• Restrict or object to certain processing, including processing based on legitimate interests.
• Withdraw consent you previously gave, such as Telegram alerts or optional analytics.

Contact contact@stackshield.org to exercise any of these. We will respond within 30 days, and we may need to verify that you control the account before acting. If you are in Kenya, the Kenya Data Protection Act 2019 applies and you may complain to the Office of the Data Protection Commissioner. If you are in the EU or UK, the GDPR or UK GDPR applies in addition to what is described here, and you may complain to your local supervisory authority. We would appreciate the chance to resolve your concern first.

11. Deleting your account

You can delete your account at any time, instantly, from Settings → Account → Delete Account — no email request and no waiting period. On confirmation, your account, encrypted tokens, stored BYOK key, MCP API keys, scan history, schedule settings, Telegram link, and associated records are permanently deleted through cascading deletion. There is no backup or recovery copy retained.

If you have an active paid subscription, it is cancelled automatically as part of deletion, so you will not continue to be billed. Payment records held by Polar and limited operational logs are retained separately as described in Section 5.

12. Cookies and analytics

We use essential cookies to keep you signed in and to secure your session. These are required for the Service to work and cannot be turned off. Your cookie choice for optional analytics is stored in your browser's localStorage.

With your consent, we may use aggregate analytics to understand which features are used and where the product is slow or confusing. We do not use advertising cookies, we do not build advertising profiles, and we do not track you across other websites. You can decline optional analytics from our cookie banner and change your mind at any time by clearing site data. See our Cookie Policy for details.

13. Children's privacy

The Service is not directed to anyone under 18, and we do not knowingly collect personal data from children. You must confirm that you are at least 18 when you sign up. If we learn that an account belongs to someone under 18, we will close it and delete the associated data.

14. No sale of personal data

We do not sell personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under the CCPA/CPRA. We do not respond to "Do Not Track" signals because we do not track users across sites. If this ever changes, we will say so here and provide an opt-out before any such processing begins.

15. Data Processing Addendum

Where applicable data protection law requires a data processing agreement (for example, GDPR Article 28), this Privacy Policy serves as that agreement. By using the Service, you acknowledge that:

• Roles: you are the data controller and StackShield is the data processor. We process your data only on your documented instructions — that is, to perform the scans and fixes you initiate.
• Purpose limitation: we process data solely for the purposes described in this Privacy Policy. We do not use it for marketing, profiling, or any purpose other than operating the Service.
• Confidentiality: access is restricted to personnel who need it to operate the Service, and they are bound by confidentiality obligations.
• Security: we implement appropriate technical and organizational measures, including encryption at rest (AES-256-GCM), encrypted transmission (TLS), and access controls (see Section 6).
• Sub-processors: we engage the sub-processors listed in Section 8, each bound to process data only on our instructions and with appropriate security measures. We will give you notice of changes that materially affect you.
• Data subject assistance: we will assist you in responding to data subject requests (access, correction, deletion, export) using the tools described in Sections 10 and 11.
• Breach notification: we will notify you without undue delay, and no later than 72 hours, after becoming aware of a personal data breach affecting your data (see Section 7).
• Deletion on termination: on account deletion or termination, we delete or return all personal data and delete existing copies, except where retention is required by law (see Section 5).
• Audit: we will provide the information you reasonably need to confirm we meet these obligations, subject to appropriate confidentiality.

If you need a separately executed DPA — for example, for enterprise procurement or GDPR Article 28(2) compliance — contact contact@stackshield.org and we will provide one.

16. Changes to this policy

We may update this Privacy Policy as the beta evolves. We will update the "Last updated" date above, and we will notify active users by email or in-app notice before material changes take effect. If a change would involve using your data for a new purpose, we will ask for your consent first where the law requires it.

17. Contact

For privacy questions, data requests, or to exercise your rights: contact@stackshield.org. You can also read our Terms of Service and Cookie Policy.