Privacy policy

Your account

You sign up with an email address and a password. The password is stored as a salted PBKDF2 hash. We never store it, or see it, in plain text.

You can also sign in with Google. If you choose that, Google sends us your email address and a Google account identifier so we can recognise your account next time. Google sends us nothing else about you.

Signing in sets one essential cookie that keeps your session open. That is the only cookie we set. There are no advertising cookies and no cross-site tracking cookies.

Your sites and your connections

You add the websites you want audited. To deploy fixes, you can connect Cloudflare or GitHub using a token you create and provide.

Those tokens are stored encrypted. We use them for two things only: running audits on your sites, and applying changes you have approved. We never use them to look at anything else in your accounts.

You can revoke a token at any time, in Cloudflare or GitHub. The moment you do, our access ends. Fixes already deployed stay in place, because they live in your account, not ours.

What we store while you use the service

We store your audit results and the evidence behind each check, the fixes proposed to you, and your deployment history, including snapshots and rollbacks. This history is the record of what changed on your site and when, and it stays attached to your account so you can read it whenever you like.

We use this data to operate the service: to run audits, deploy the changes you approve, verify them, and show you the results. We do not sell personal data. We do not share it for advertising.

Payments and email

Payments are handled by Polar. Your card details go directly to Polar. DeployFound never receives them and never stores them. We keep a record of your subscription status so the product knows which plan your account is on.

Transactional email, currently password reset messages and deliveries from the pricing page contact form, is sent through Resend. We send account email only. There is no marketing list and no newsletter unless that changes and this page says so.

Who processes data for us

Five services process data on our behalf, each for one job:

• Cloudflare hosts and runs the service, and stores its data.
• Polar takes payments and manages subscriptions.
• Resend sends transactional email, such as password resets, and delivers messages sent through the pricing page contact form.
• Google provides sign-in, only when you choose the Google option.
• Google Analytics provides web analytics, operated by Google, and sets measurement cookies.

That is the whole list. If it grows, this page grows with it.

Deleting your data

Email contact@deployfound.com and ask. We will delete your account and the personal data attached to it, and confirm when it is done. Records we are legally required to keep, such as payment records held by Polar, stay with the processor that holds them.

If this policy changes, the new version goes on this page and the date at the top changes with it. Material changes will also be announced to account holders by email before they take effect.