Last updated: August 13, 2026
Unbeta (“Unbeta,” “we,” “us”) is the data controller for the personal information described below.
Account information. Sign-in is handled by Supabase Auth. If you sign in with Google or GitHub (the primary method), that provider shares your email address and basic public profile info (name, avatar image) with us — we request no scopes beyond that, and never see your Google/GitHub password. If you use the email code fallback instead, we only collect the email address you type in; there is no password on any path.
Targets you submit. The domain/URL you enter to scan, and the scan results we generate for it (Beta Score, pillar scores, findings list).
Verification data. A short-lived random token used to confirm you control a domain (via a DNS TXT record or meta tag you add yourself).
Usage/technical data. IP address and request metadata, used only for abuse prevention (rate limiting, SSRF protection, and Cloudflare Turnstile bot-check) — not for tracking you across the web.
Analytics (optional). If PostHog is enabled, we collect event properties we deliberately keep minimal — scores, counts, methods, UTM tags. We never send a scanned domain, a specific finding, or any secret value to our analytics provider. Analytics is fully disabled if no analytics keys are configured, and does not depend on your consent to operate the core Service either way.
Payment information. If you upgrade to a paid plan, card/billing details are collected and processed entirely by Stripe via their hosted Checkout and Customer Portal — we never see or store your full card number. We do store your Stripe customer/subscription IDs and plan status so we can enforce your plan’s limits.
We do not persist raw secrets. If a scan finds an exposed API key, credential, or private key, we store only a redacted preview (first/last few characters) long-term. The full raw value is held in short-lived cache for up to five minutes so you can view it once, then it is permanently and automatically destroyed — never logged, never written to our primary database.
We do not read or store the private contents of your app beyond what a scan touches (public-facing pages, response headers, and — for the authenticated flow — the specific checks each pillar performs). We don’t access your target’s database, admin panel, or non-public data.
We do not sell your personal information, and we do not use the contents of your scans to build a public dataset without your explicit opt-in (see §6 on the shareable score card).
| Purpose | Provider | Notes |
|---|---|---|
| Database + auth | Supabase (Postgres) | Row-Level Security scoped to your account — other users cannot read your rows. |
| Sign-in (OAuth) | Google, GitHub | Only used if you choose “Continue with Google/GitHub” — shares your email + basic profile. See each provider’s own privacy policy. |
| Ephemeral cache/queue | Upstash (Redis) | Verification tokens, rate-limit counters, secret-reveal tokens (5-min TTL). |
| Load-test execution | Railway | Runs the Traffic-pillar load test you explicitly trigger; receives only the target URL for that run. |
| Bot/abuse protection | Cloudflare (Turnstile) | Standard challenge widget; see Cloudflare’s own privacy policy for what it collects. |
| Analytics (optional) | PostHog | Minimal event properties (scores, counts, methods, UTM) plus standard IP/browser metadata PostHog collects by default. |
| Payments | Stripe | Card data never touches our servers; we only store customer/subscription IDs and status. |
| Hosting | Vercel | Standard application hosting/CDN. |
Each of these processes data only as needed to provide the Service.
If you click “Share my score,” a public page is created showing only your score numbers (Beta Score, pillar scores) and domain — never the detailed findings, and never a raw secret. This page is only created when you explicitly choose to share; it is never public by default.
Depending on where you live, you may have the right to access, correct, export, or delete your personal information, and to object to or restrict certain processing. To exercise these rights, contact us at seattlefishbox@gmail.com.
The Service is not directed at children under 13 (or the relevant age in your jurisdiction), and we do not knowingly collect personal information from them.
We use industry-standard measures to protect your data, including Row-Level Security on our database, SSRF protection on all scanning infrastructure, and automatic destruction of sensitive scan findings (see §3). No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.
We may update this policy from time to time. Material changes will be communicated via a notice on the site.
Questions about this policy or your data: seattlefishbox@gmail.com
This page has not been reviewed by a lawyer. It’s a good-faith first draft, adapted from comparable scanner SaaS products, and will be revised as Unbeta grows — particularly around GDPR/CCPA-specific mechanics once we know where our users are located.