Privacy Policy

Last updated: October 18, 2026

This Privacy Policy explains how Kraftwire Software ("we", "us", "our") collects, uses, and protects your information when you use SimplyScan ("Service"), including its security scanning, speed optimization, and uptime monitoring features.

1. Information We Collect

Account Information

When you create an account, we collect your email address. You may sign up using email and password, or through a social sign-in provider (Google or Apple). We use your email for authentication, scan history association, and service communications. Your profile may also include an optional display name and avatar image that you choose to upload.

Social Sign-In (Google, Apple)

When you sign in with Google or Apple:

  • We receive your email address and basic profile information (name) from the provider.
  • Social sign-in does not give us access to your contacts, calendar, drive, files, or Analytics reports.
  • Social sign-in data is used exclusively to create and authenticate your account.

Tokens. Your SimplyScan sign-in session is managed using secure session tokens. Tokens for the optional Google Analytics connection are handled separately, as described below.

Independence. SimplyScan (operated by Kraftwire Software) is not affiliated with, endorsed by, or sponsored by Google LLC or Apple Inc. Social sign-in is offered purely as an authentication convenience, and your use of it is also subject to those providers' terms and privacy policies. You are responsible for maintaining the security of the third-party account you use to sign in.

Google User Data Disclosure

SimplyScan's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Scopes requested for Google sign-in:

  • email · Your Google account email address
  • profile · Your name
  • openid · Authentication identity verification

Google sign-in requests only the identity scopes listed above, not access to your Google Drive, Gmail, Calendar or Contacts. Data received through Google sign-in is used only for authentication and account identification, not for advertising, analytics, profiling or training AI/ML models. If you separately choose the optional Google Analytics connection, we request analytics.readonly and use that data only for your requested report, as described in Optional Google Analytics connection below. We do not sell or rent Google user data; our service providers process it on our behalf as described in this policy, and disclosures may be required by law.

Payment Information

Payments (Pro Reports and Pro Monitoring subscriptions) are processed through Stripe. We do not store your credit card number, CVV, or billing address. Stripe handles all payment data in accordance with PCI DSS standards. From Stripe we receive and store the payment status, a transaction reference, and the billing email address associated with the purchase, so we can link purchases and subscriptions to your scans and account.

Scan Data

  • URL Scans: We analyze the publicly served output of your application (HTML, JavaScript, HTTP headers, configuration files) · the same content any visitor to your URL can already see. We store the scanned URL and the scan results (findings, score, summary). Scans run while signed in are associated with your account; you can also run free scans without an account and attach them to your account when you later sign in.
  • Request metadata: We log the IP address that requested each scan. We use this for rate limiting (free scans are limited per IP per day), abuse prevention, and to attribute anonymous scans and rescans to their owner.
  • Speed Optimization Scans: Speed analysis examines publicly visible JavaScript bundles, HTTP responses, and resource loading patterns · no additional data beyond what is publicly accessible is collected or processed.
  • GitHub Repo Scans (Pro): We fetch and analyze files and commit patches from public repositories or private repositories you authorise. Source files are processed in memory and discarded after results are generated; scan findings and metadata can retain code evidence, with detected credentials withheld from displayed content.
  • MCP server: URL and repository scans started through MCP use the same scan storage as website scans; the local-code tool sends selected files for in-memory analysis and retains findings and coverage rather than the submitted source.
  • Verification pages & trust badges: If you enable a trust badge or share a scan verification link, the scanned site's hostname, score, and scan date become publicly visible on that page and badge. Full findings are never shown publicly.

Usage Data

We use Google Tag Manager (GTM) to manage analytics tags. The tags loaded through GTM are Google Analytics 4 and Microsoft Clarity, which may collect usage data such as page views, device type, and browser information. These tags load only if you choose "Accept all" in our cookie banner, and then only after your first interaction with the page (scroll, tap, or keypress) · never before you consent, and never if you choose "Essential only" or close the banner. We do not use browser fingerprinting, and we do not sell your data to advertisers or data brokers.

Session Recording and Heatmaps

Microsoft Clarity records session replays and heatmaps: the pages you open, how far you scroll, and where you click. Clarity runs in strict masking mode, which masks all text inside your browser before anything is sent · Microsoft does not receive the text displayed on the page, nor anything you type into a field. A replay shows the layout of the page and where you moved and clicked, with the text blanked out.

This matters most for our free tools. Our client-side tools (JWT debugger, hash and password generators, environment-file linter, and the other browser-only utilities) process what you paste entirely on your device. Nothing you enter into them is transmitted to us, and strict masking means it is not captured in a Clarity recording either.

Clarity does not load if you choose "Essential only" in our cookie banner. You can also read Microsoft's Privacy Statement.

Free Tools Usage Data

When you run one of our free live-check tools (SSL checker, security headers, email security, DNS security, SEO checker, AI visibility, CORS tester, security.txt validator, exposed files scanner), we log the domain or URL you checked, the result summary (score or grade), browser user-agent, referring page, and a timestamp; server-tool logs discard the raw IP address, and short-lived rate-limit buckets use a derived identifier. We use this for rate limiting, abuse prevention, and to understand which tools help and how results improve over time. Our client-side tools (generators, converters, debuggers) run entirely in your browser · nothing you enter into them ever leaves your device; we record only that the tool was used.

Uptime Monitoring & Status Pages

If you use Pro Monitoring, we store the monitors you configure (the monitored URL and its name) and the results of the automated checks our infrastructure performs against them roughly every five minutes. Check history is retained for 95 days and then automatically deleted. Status pages are visible publicly only for monitors you choose to make public; a public status page shows the monitor's name, current status, and recent uptime to anyone with the link.

Emailed Reports & Email Delivery

You can email a scan report to an address you enter; we store that recipient address as part of our email delivery log (recipient, template, and delivery status), which we keep for transactional and newsletter email so we can trace delivery problems and honor unsubscribes. Report and newsletter emails are sent from notify.simplyscan.io via our email delivery provider.

Feedback

Our in-app feedback widget is provided by Feedback Fish. Feedback you submit · and, if you are signed in, your account email address · is processed by Feedback Fish solely to deliver the feedback to us.

Workflow Integrations (Slack, GitHub, Linear)

If you connect Slack, GitHub, or Linear, we store the webhook URL, token, or API key you provide and use it to send requested scan findings and enabled monitoring alerts, including outage and recovery notices. You can remove a connected integration at any time, which deletes the stored credential.

2. How We Use Your Information

  • To provide and deliver security scan and speed optimization reports.
  • To maintain your scan history and dashboard.
  • To run uptime monitoring and deliver findings to the integrations you configure.
  • To process payments for Pro Reports and Pro Monitoring subscriptions.
  • To enforce rate limits and prevent abuse of the Service.
  • To respond to support requests.
  • To improve the Service's accuracy, features, and speed optimization analysis.
  • To send you product updates, new features, security tips, and service announcements.

3. Data Sharing

We do not sell or rent your personal information. We share data only with the service providers needed to operate SimplyScan, and only to the extent necessary:

  • Stripe: For payment and subscription processing.
  • AI providers: Scan content (the publicly served output of the scanned URL, or repository source files during a Pro repo scan) is sent through the Lovable AI Gateway (operated by Lovable, which also provides our hosting and development platform) to large-language-model providers · currently Google Gemini models · for analysis. No personally identifiable information is included in AI requests beyond the content being scanned.
  • Analytics: Google (Tag Manager, Analytics 4) and Microsoft (Clarity) receive usage data through the tags described in Usage Data above. Microsoft Clarity also receives session replay and heatmap data, with all page text masked in the browser before it is sent.
  • Feedback Fish: Processes in-app feedback you submit.
  • Your integrations: If you connect Slack, GitHub, or Linear, requested findings and enabled monitoring alerts are sent to that service.
  • Infrastructure & email delivery: Our hosting, database, and email providers process data on our behalf on the infrastructure described in Data Security. Account, report and newsletter emails are sent through Lovable's managed email service.
  • Cloudflare: When a scan needs a real browser to observe how a page behaves, the scanned page is loaded in Cloudflare's Browser Rendering service. Only the scanned URL and what that page serves are processed.
  • Google Chrome UX Report: Scans and the SEO checker may send the scanned URL to Google's Chrome UX Report API to read publicly available real-user speed data for that site.
  • Domain and DNS lookups: To check domain health we look up the scanned domain in public registration (RDAP) services and DNS resolvers. Our DNS Lookup tool queries Google Public DNS directly from your browser for the domain you enter.
  • Have I Been Pwned: When you choose a password for your account, your browser sends the first 5 characters of the password's SHA-1 hash to the Pwned Passwords range API to check whether it has appeared in a breach. Your password and its full hash never leave your device.
  • IP geolocation: For abuse review, our admin tools look up the approximate city and country of the IP addresses that requested scans through ipwho.is.
  • Legal obligations: If required by law, regulation, or valid legal process.

4. Data Retention

  • Account data: Retained while your account is active. Deleting your account from Settings permanently removes your account, profile, and scan history. Any active Pro Monitoring subscription stops renewing and ends at the end of the current billing period; no refund is given.
  • Scan results: Retained for your scan history while your account is active. You may request deletion of individual scans (including anonymous scans) by contacting support.
  • Source code (repo scans): Fetched source files are processed in memory rather than retained as files; findings can retain code evidence, with detected credentials withheld from displayed report content.
  • Uptime check history: Retained for 95 days, then automatically deleted.
  • Payment records: After account deletion, retained payment rows keep transaction references, status, amount and date, but lose the customer email, paid-guest access token hash and scan link; unclaimed paid scans associated with the deleted account or matching buyer email are also removed.
  • Free tools usage logs: Server-side free-tool run logs are scheduled for deletion after 365 days. Aggregate daily browser-tool usage counts have no automatic expiry.

5. Data Security

We use account authentication, database row-level access controls and encrypted service connections to restrict access to stored data.

Stored Google Analytics and Supabase OAuth tokens use server-side encryption; GitHub repository OAuth tokens are handled transiently as described below.

No technical safeguard or scan can guarantee complete security.

6. Communications & Newsletter

Essential Account Communications

These are required for the operation of your account and cannot be opted out of while your account is active. They include: password resets, email address changes, account security alerts, account deletion or freezing notices, billing confirmations, and service disruption notifications.

Product Updates & Newsletter

By creating an account or subscribing to our newsletter, you agree to receive product news, new feature announcements, security tips, and promotional content. The newsletter is double opt-in: when you subscribe, we send a confirmation email to verify your address, and you only start receiving the newsletter after you click the confirmation link. If you subscribe while signed in with the same verified email address, your subscription is confirmed immediately without a separate confirmation email. We store your email address, subscription status, and subscription date solely to send you the newsletter.

Opting Out & Deletion

You can unsubscribe at any time using the link in any newsletter email, or by emailing simplyscan@kraftwire.com. Unsubscribing is a soft delete: we mark your address as unsubscribed and stop emailing you, but retain a minimal record so we can honor your opt-out. To have your subscriber data permanently and fully deleted (a hard delete) · including if you subscribed without ever creating an account · email us or use the in-app feedback widget, and we will remove it. Opting out of marketing does not affect essential account communications.

7. Your Rights

You may:

  • Request a copy of your stored data.
  • Delete your account and associated scan data yourself at any time from Settings, or request deletion by contacting us.
  • Opt out of product updates and newsletter emails as described in Communications & Newsletter. Essential account communications cannot be opted out of while your account is active.

To exercise these rights, contact us at simplyscan@kraftwire.com.

8. Cookies & Local Storage

We use essential cookies and browser local storage for authentication, session management, and interface preferences such as your theme choice. Analytics tags loaded via Google Tag Manager also set cookies: Google Analytics 4 sets cookies whose names begin with _ga, and Microsoft Clarity sets _clck and _clsk, as described in Usage Data. You can decline these non-essential tags by choosing "Essential only" in our cookie banner · they will not load for you · or block them in your browser settings, though this may affect some Service functionality.

9. Children's Privacy

The Service is not intended for users under 16 years of age. We do not knowingly collect information from children.

10. Third-Party Platform Information

The Service may display publicly available information about the features and capabilities of third-party platforms for comparison purposes. This information is gathered from public sources such as official documentation, release notes, and marketing materials. Comparison pages use public information; optional connections to your private repository, Analytics property or Supabase project are separate features described in this policy. This comparison data is provided "as is" for informational purposes and may not reflect the most current state of any third-party product.

11. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be communicated via the Service or email. Continued use after changes constitutes acceptance.

12. Contact

For privacy-related questions or data requests, contact us at simplyscan@kraftwire.com.

Optional Google Analytics connection

Pro customers can choose to connect Google Analytics using Google’s read-only Analytics permission (analytics.readonly). This connection is separate from signing in to SimplyScan with Google. We use it to list accessible properties and read daily, aggregated sessions, engaged sessions, key events and the session key event rate for the property and landing page you select. We do not request visitor identifiers, demographic profiles or individual event records, and we cannot change your Analytics property.

We store your selected property ID, page hostname and path, property time zone, refresh date and daily aggregates. We discard URL query strings and fragments. Do not select a path that contains personal information. Days with fewer than 10 sessions are not retained. Imported daily data is removed after at most 90 days, with hourly cleanup. Choosing another page replaces the previous imported report. Access and refresh tokens are encrypted on our server and are never returned to your browser; unused connections are deleted after 90 days of inactivity.

The private report compares these aggregates with public, exact-page mobile Chrome UX Report (CrUX) history when available. CrUX describes a different visitor population and uses rolling periods. We show a comparison only when each of two non-overlapping 28-day periods has at least 1,000 sessions and 20 key events, with no known Analytics thresholding, sampling or omitted low-volume days. Showing these measures for the same periods does not prove causation or predict revenue.

Google data is used only to provide your requested Analytics report. It is not sold, used for advertising, sent to an AI model, used to train models, or included in public scan reports. Our hosting and database providers process it on our behalf to deliver this feature. Access by personnel is limited to support you explicitly authorise, security investigation, or legal obligations.

SimplyScan’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

You can disconnect in Dashboard → Integrations → Google Analytics. Disconnect deletes the stored tokens and imported aggregates, and requests revocation from Google. If Google is unavailable, we still delete our copy and tell you how to revoke access in your Google Account. Deleting your SimplyScan account also deletes the connection and imported data. Questions or deletion requests: simplyscan@kraftwire.com.

Repository access, remote secrets and local-code tools

GitHub repository OAuth requests the broad repo permission, but SimplyScan uses the token for read-only requests to the repository you select.

The token is held in browser component memory and in the current scan request, not saved in our repository-scan database; reloading or disconnecting clears the browser copy, while revoking the grant requires GitHub settings.

We retain a short-lived, hashed OAuth state for the connection flow and repository scan metadata such as pinned commit IDs, checked-commit progress and findings.

Remote secret checks inspect fetched content in memory, and detected credentials are masked or withheld in displayed report content. We retain the original target URL for scan operations, including when it is withheld from displayed reports; do not include credentials in a target URL.

The MCP local-code tool, CLI, pre-commit hook and GitHub Action transmit the source files you select to our scan endpoint, which processes them in memory and stores a report, coverage and file metadata rather than retaining the submitted source.

Optional URL and repository explanations send bounded source excerpts, filenames and findings through the Lovable AI Gateway after detected credentials are withheld from the outgoing fields; local-code scans use the deterministic engine without that AI explanation step.

Browser capture and queued checks

Cloudflare Browser Rendering may load a scanned page and observe its public network activity, including data returned but absent from the initial rendered view.

Returned row values are discarded after comparison; findings can retain endpoint and field names, counts and coverage information, with detected credentials withheld.

When capacity is unavailable, we store a scan-linked queue job and safe target URLs and may add a later observation without changing the original score.

Eligible minimal browser summaries are cached for two minutes without GraphQL documents, variables, response values or credentials.

Bubble export files are not currently accepted, and private Bubble privacy-rule definitions are not automatically imported.

Threat telemetry and owner tests

With verified ownership and an optional Supabase OAuth connection, we read selected authentication-log events for the authorised project and store encrypted access and refresh tokens, the project reference and a processing cursor.

Normalised events can contain time, IP address, method, path, status and a hashed account identifier; raw email addresses, request bodies and log messages are not copied into those events.

Disconnecting removes our stored Supabase connection; revoke the application in Supabase separately if you want to withdraw the provider grant.

Threat-event cleanup removes events older than 20 minutes. Threat-alert history without pending delivery is pruned 30 days after it was last seen, or earlier to enforce a 512-row limit per monitored app; pending deliveries can be retained for retries.

Active owner audits process your supplied test endpoints, accounts, tokens and canaries and store the consent version, target origins, execution status and results.

Database-port and TLS checks store observed connection or handshake results, including partial or not-tested coverage, rather than treating an unavailable check as successful.

Breach checklist, badges and guest access

The breach-readiness checklist stores four account-linked confirmations and an update time; these are your statements about your process, not our verification.

Badge rechecks store a scan-linked check time, authenticated TLS status and the exact certificate expiry when available, selected header names, and a current, warning, regression or unavailable result, and expose the light-check status and available expiry alongside the full-scan score and date.

A paid-guest token is stored in your browser and its hash is stored with the purchase to control report access; deleting the associated account scrubs the stored token hash.

Account deletion also removes account-linked breach checklist entries, while deleting a scan removes its badge cache.

Public speed data and service providers

Google receives the scanned page URL or origin when we request current or historical Chrome UX Report measurements, and available measurements can be stored in the scan report.

Published-research conversion and session-engagement estimates use external study results, not personal Analytics data or a calculation of your lost revenue.

GitHub processes repository authorisation and source requests; Stripe processes checkout and subscription payments; Cloudflare processes proxy traffic and optional browser rendering; Google provides CrUX, optional Analytics access and the current Gemini explanation model through Lovable.

Lovable provides hosting and managed transactional email, Supabase provides database and authentication services, and connected Slack, GitHub or Linear destinations receive the alert content needed for your configured integration.

Delivery records can retain recipient or destination references, message status, attempts and retry times so failed alerts can be retried.

Additional scanning services and API credentials

Dependency checks send package names, ecosystems and versions to OSV (api.osv.dev).

Certificate-transparency monitoring sends the monitored domain to SSLMate’s Cert Spotter when configured, or to crt.sh otherwise.

Pro API keys used by MCP, the CLI and CI are shown when created. Our database stores a SHA-256 hash linked to your account, together with creation and revocation records, rather than the original key. Revoking a key disables its use.