Privacy

Holefind is run by AI FRAME APPS LTD, a company in the United Kingdom ("we", "us"). Registered in England and Wales, company number 15936914. Registered office: 2 Branston Street, Birmingham, B18 6BP, England. We are the data controller for the personal data described here. You can contact us at [email protected].

The short version

• We read your code to write your report, then delete our copy straight away.
• We keep the report so its link keeps working.
• We never sell your data, and we do not train any models on your code.

Your code

When you start a check, we make a shallow, read-only copy of the repo on our server. The review is performed by Anthropic's Claude on our account, which we use only to produce your report. Anthropic's own privacy policy covers how it handles the data it receives. The copy is deleted as soon as the review finishes, whether it succeeds or fails. If our server restarts during a check, any leftover copy is deleted when it starts again. We do not keep your source code. To find secrets that were committed and later deleted, we also download the repo's recent git history (the default branch, up to the newest 1000 commits, files under 200 KB) and delete it with the copy. Our scanners run on our own server with no network access: dependency lists are checked against a copy of the public OSV vulnerability database kept on our server, so they are never sent to anyone else. Secret values are hidden by the scanner and never stored, logged or shown to the reviewer; we keep only the file, line, rule and commit where one was found, alongside the report.

For private repos, we only get access if you connect GitHub and choose the repos. The access token GitHub gives us is kept in memory for up to one hour so you can pick a repo. It is never written to disk. For a full review or a re-check of a private repo you have granted, our GitHub App asks GitHub for a new access token that works only on the repos you chose and expires within an hour; we use it to make the copy and never store it. You can remove our access at any time in your GitHub settings.

What we store

• Reports. The repo address, the report text (which can quote file names and short descriptions of your code) and when it was made.
• Feedback on findings. If you mark a finding as "Not an issue" or "Fixed", we store your choice and any comment you add with the report, so we can check our findings. It is deleted when you delete the report or your account.
• Payments. Stripe handles card details. We never see them. Stripe sends us the checkout session ID, amount, payment status and the email address you paid with, which we keep to connect the payment to your report and to answer support questions.
• Abuse protection. A keyed one-way hash of your IP address (we never store the address itself), used to limit how many checks can be started per hour.
• Visit statistics. We count visits on our own server, with no cookies and no fingerprinting. For each visit we store only the type of page (for example "report page", never the report's address), the website that linked to us reduced to its domain name, any campaign tags in the link, and whether the device is a phone, tablet or computer. We never store your IP address or browser details for this. If you use certain buttons, such as copying a report link or a fix prompt, we record only that the button was used. These records are deleted after 400 days. When you start a check, we also keep the linking domain and campaign tags with that check, so we can see which sites lead to checks and purchases; they are deleted with the report.
• Live site checks. If you run a live site check, we store the address you entered (without anything after the ?), the address it ended up on, the findings and a short summary such as which security headers were present and certificate dates. We never store the site's pages, scripts or cookie values. If we find a secret key, we store only its type, where it was, and its first 4 characters and length. A keyed hash of your IP address limits each connection to 5 site checks an hour and is deleted after 30 days. How the site check works.
• The optional database test. If your site uses Supabase and you tick the box to confirm the app is yours, we also test whether its database can be read with the public key your site already gives every visitor. We use only that public key, send only count-only and read-only requests, and never read, store or show any row. We store which tables were readable (by name and row count), which storage buckets were public (by name), and the fact that you gave consent. We never store the key. This test only ever runs against the Supabase project found in your own site's code, never an address you type. You can leave the box unticked and we skip it.
• Security log. A record of important actions so we can spot and investigate misuse: sign-in links requested, sign-ins and sign-outs, account changes and deletion, sharing changes and each time a shared report is opened through its link, opening a link we emailed you, checks started, checkout, payments, refunds and disputes (the amount and which report), and every action our staff take. Each entry has the time, the action, your account number if you are signed in, your email address shortened to its first letter and domain (like a•••@example.com), and a keyed one-way hash of your IP address. It never includes sign-in links, your full email address or your code. Kept for 400 days. If you delete your account, the shortened email is removed from its entries.
• Server logs. Standard technical logs (such as errors), kept for up to 30 days.

Cookies

We use no advertising cookies. The cookies below that are strictly necessary make the site work and do not need your permission. Analytics cookies are only set if you choose "Allow", and you can change your choice at any time with "Cookie settings" at the bottom of every page.

Accounts

You never need an account to check a repo. An account is optional and only keeps your reports in one place.

• What we store. Your email address, and if you sign in with GitHub, your GitHub user ID and username. Which reports belong to your account. Session records for the devices you are signed in on (when each started, when it was last used and when it expires). Sign-in links are stored only in a scrambled one-way form, never as the link itself.
• How long. Your account and its reports: until you delete the account. Sessions: 30 days, or until you sign out. Sign-in links: 15 minutes, or 7 days for the link in a report email (one you asked for, or the one we send after you buy a full report). Each link works once.
• Deleting it. You can delete your account yourself on the Account page. That deletes your account, its reports and its sessions straight away from our live systems. Copies can remain in our encrypted backups until those expire (see Backups). We keep payment records for tax, as described below, with your email address removed.
• Combining accounts. If you add an email address to your account that already has its own account, or connect a GitHub account that already has one, we move that account's reports into yours and delete the other account. This only happens after you prove you control both, by using the link we email or by signing in with GitHub.
• Email. We only email you sign-in links you ask for, a link to confirm an email address you add to your account, a report link you ask us to send, a confirmation that your payment arrived, and the link to a report you have paid for. No newsletters and no marketing. Our emails contain no tracking pixels.

When you buy a full report, we use the email address you gave Stripe to send you the report link and to add the report to an account for that address, so you can find it again. If you are signed in when you buy, we fill in your account's email on Stripe's page for you. Coming back from Stripe does not sign you in: the browser you paid in can open the report straight away, and the email we send you holds a sign-in link for that account.

Who can see your report

A report that is not saved to an account can be opened by anyone who has its link. Once a report is saved to an account, only that account can open it, unless its owner turns on sharing: anyone with the share link can then view it until the owner turns sharing off or makes a new link. Our staff can open reports only to give support, to fix problems or to investigate abuse.

Analytics

To understand how people use the site and fix what is confusing, we use PostHog, a product analytics service, in its United States region. Your browser never talks to PostHog directly: it sends to our own server, which passes the data on.

• Before you choose, or if you choose "No thanks". We count visits without cookies. PostHog tells visits apart with an anonymous code it works out on its own servers from your IP address and browser details, mixed with a secret that changes every day, so the same visitor cannot be followed from one day to the next. PostHog removes the IP address from these visits once the code is made. No session recordings.
• If you choose "Allow". PostHog sets a first-party cookie on our site so it can tell your visits apart over time, and may record your session: page layout, scrolling and clicks. Everything you type, and all report content (findings, summaries, repo names, prompts, site check results), is hidden in the browser before anything is sent.
• What is sent. Which kind of page you viewed (for example "report page", never the report's address), buttons and links used, and simple counts such as how many findings a report has. We remove anything after the ? in addresses and replace report and payment IDs before sending. We never send the repo or site address you enter. Our server passes your IP address to PostHog: without cookies only for the daily code above, and if you choose "Allow" also to work out your approximate location (such as country and city).
• On our server. We also send PostHog a note when a check finishes or fails and when a report is bought (score, number of findings, how long it took, amount), under a random ID that is not linked to you or to your report.
• No ads, no selling. PostHog processes this data for us. We do not use it for advertising and we do not sell it.

Your browser keeps a small note of your choice for 6 months, and PostHog's code keeps its own note there of whether cookies are on. Neither note contains an identifier. You can change your choice at any time with "Cookie settings" at the bottom of every page. If your browser sends Global Privacy Control or Do Not Track, we never ask and only count visits without cookies. Our own visit statistics (above) are separate and never use cookies.

Why we use it (lawful basis)

We handle personal data under UK data protection law (the UK GDPR and the Data Protection Act 2018). We use your data to provide the service you asked for (contract), to keep the service safe and prevent abuse (legitimate interests), and to keep payment records as the law requires (legal obligation). Counting visits without cookies is in our legitimate interests in improving the site. Analytics cookies and session recordings are used only with your consent, which you can withdraw at any time with "Cookie settings".

Who we share it with

• Anthropic, to run the review.
• Stripe, to take payments.
• GitHub, to fetch your repo.
• Contabo, which hosts our server.
• Cloudflare, which sits in front of our website to deliver it quickly and protect it from attacks. All traffic to the site passes through Cloudflare, so it handles your IP address and the pages and requests you send and receive. Cloudflare also stores our encrypted backups (see Backups); they are encrypted on our server before upload, so Cloudflare cannot read them.
• Namecheap, which hosts our email and delivers the emails we send you (sign-in links and report links). It receives your email address and the email's content.
• PostHog, for product analytics and, if you allow it, session recordings (see Analytics). Its servers are in the United States.
• Telegram, which we use to notify ourselves when a check finishes or a report is bought. These notifications include the repo address, the score and the report link, never your code or payment details. When someone creates an account, we are told only the new total number of accounts, never who it was.

Some of these providers process data outside the UK, for example in the United States or the EU. Where they do, they use safeguards recognised under UK data protection law.

Backups

Every night we back up our database (accounts, reports, payment records and the other records described above) so we can recover from a failure. Backups never contain your source code. Each backup is encrypted on our server before it leaves, and the key that opens it is kept offline, not on our server. We keep daily backups for 30 days and one backup a month for 12 months, then they are deleted. This means something you delete can remain in a backup until that backup expires. We only open a backup to recover from a failure.

How long we keep it

Source code: deleted as soon as the check finishes. Reports: kept until you ask us to delete them, or until you delete the account they belong to, so your link keeps working. Accounts: until you delete them. Sessions: 30 days. Sign-in links: 15 minutes, or 7 days for the post-purchase email. Payment records: kept for 6 years, as UK tax law requires. IP hashes: 30 days. Backups: 30 days (daily) and 12 months (monthly), as described above.

Your rights

You can ask us for a copy of your data, to correct it, or to delete it, including deleting a report. If you have an account, you can delete it and its reports yourself on the Account page. Otherwise, email [email protected] with your report link. If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk.