Terms of Service

Last updated: October 18, 2026

These Terms of Service ("Terms") govern your use of SimplyScan ("Service"), operated by Kraftwire Software ("we", "us", "our"). By accessing or using the Service, you agree to be bound by these Terms.

1. Service Description

SimplyScan provides security and performance scans of deployed applications, GitHub repositories and source files you choose to submit through our supported tools.

Free URL scans provide a limited report; paid Pro Reports include additional checks and report detail, repository scanning and PDF export.

Pro Monitoring adds subscription scan credits, scheduled checks, uptime and threat monitoring, and connected alert destinations.

Checks are bounded by the available source, provider permissions, runtime support and processing limits; a partial or not-run result is not a pass.

The price and currency displayed in Stripe Checkout are the amount you authorise, including any applicable discount.

2. AI-Generated Results & Disclaimer

SimplyScan uses artificial intelligence to analyze code and identify potential vulnerabilities and performance issues. AI-generated results may contain inaccuracies, false positives, or false negatives. The Service does not guarantee that all vulnerabilities or performance bottlenecks will be detected, nor that every finding represents an actual security risk or measurable performance impact.

Scan reports are provided on an "as-is" basis and should be treated as a starting point for your security and performance review, not as a definitive or exhaustive audit. You are solely responsible for verifying findings and implementing fixes in your own codebase.

SimplyScan is not a substitute for professional penetration testing, manual code review, dedicated performance profiling, or a dedicated security team.

3. Pro Report Payments & Refunds

Pro Report payments are processed through Stripe as a one-time payment per report; there is no recurring charge for Pro Reports. We do not store your payment card details. Each Pro Report includes two (2) complimentary rescans of the same URL or repository within 14 days of purchase, at no additional cost. To access free rescans, you must be signed in to the account associated with the original purchase so we can verify ownership and correctly attribute the rescans.

Pro Report payments are non-refundable. Because each Pro Report is a digital product delivered immediately upon scan completion, all sales are final once the report has been generated.

However, at our sole discretion, we may grant a complimentary replacement Pro scan if:

  • A scan fails due to a technical error on our end (e.g., server timeout, scan engine crash).
  • A report is substantially incomplete or malformed due to a Service defect · not due to your application being inaccessible or returning errors.

To request a goodwill replacement scan, contact us at simplyscan@kraftwire.com with your scan ID and a description of the issue. Goodwill replacement scans are granted entirely at our discretion and do not constitute an obligation or precedent.

4. Pro Monitoring Subscription

Pro Monitoring is a recurring subscription billed through Stripe, monthly or yearly at the price shown before payment. By subscribing, you authorize recurring charges until you cancel.

  • Scan credits: Monthly plans grant 2 Pro scan credits per billing period; yearly plans grant 24 credits for the subscription year. Unused credits expire at the end of the billing period in which they were granted and do not roll over.
  • Cancellation: You may cancel at any time through the billing portal in your account. Cancellation stops future renewals; your subscription remains active until the end of the current billing period, and subscription fees already paid are non-refundable.
  • Uptime monitoring: Monitoring is provided on a best-effort basis with no uptime-detection SLA. We do not guarantee that every incident will be detected or that alerts and integrations will be delivered without delay. Status pages you choose to make public are visible to anyone with the link.
  • Integrations: Slack, GitHub, and Linear integrations use credentials you provide. You are responsible for the permissions those credentials grant, and you can remove a connected integration at any time.

5. Accounts

  • You may create an account using a valid email address or a supported social sign-in provider. You are responsible for maintaining the security of your credentials.
  • You can delete your account at any time from Settings. Deletion is permanent and removes your account, profile, and scan history. Any active Pro Monitoring subscription stops renewing: it still ends only at the end of the current billing period, and no refund is given for fees already paid.

6. Communications

By creating an account or subscribing to our newsletter, you consent to receive product updates, new feature announcements, security tips, and marketing communications from us. Essential account notifications (password resets, email changes, security alerts, account deletion or freezing, billing confirmations, service disruptions) cannot be opted out of while your account is active. You may opt out of marketing and newsletter emails at any time via the unsubscribe link in any newsletter email or by contacting simplyscan@kraftwire.com. Permanent (hard) deletion of newsletter subscriber data is available as described in our Privacy Policy.

7. Acceptable Use

You agree not to:

  • Use the Service to scan or monitor applications you do not own or have authorization to test.
  • Attempt to exploit, reverse-engineer, or interfere with the Service's infrastructure.
  • Use scan results to attack or exploit vulnerabilities in third-party applications.
  • Automate or script access to the Service beyond its intended interfaces (the web app and our published MCP server, CLI, pre-commit hook and GitHub Action), or circumvent rate limits.

8. Intellectual Property

Scan reports generated by the Service are licensed to you for your personal or internal business use. You may share reports with your development team or stakeholders. You may not resell, redistribute, or publicly publish reports for commercial purposes.

9. Data Handling

For URL scans (including speed optimization analysis), we analyze the publicly served output of your application · the same content any visitor can already see. For GitHub repo scans, we process source files in memory rather than retaining the files; report findings can retain code evidence, with detected credentials withheld from displayed content. See our Privacy Policy for full details, including what we log and how long we keep it.

10. Limitation of Liability

To the maximum extent permitted by law, Kraftwire Software shall not be liable for any indirect, incidental, special, consequential, or punitive damages arising from your use of the Service, including but not limited to damages resulting from:

  • Security vulnerabilities or performance issues not detected by the Service.
  • Inaccurate or incomplete scan results, including speed optimization estimates.
  • Undetected downtime, missed or delayed monitoring alerts, or status page inaccuracies.
  • Actions taken based on scan findings.
  • Inability to access the Service.

Our total liability shall not exceed the amount you paid for the specific scan that gave rise to the claim or, for claims relating to Pro Monitoring, the subscription fees you paid for the billing period in which the claim arose.

11. Modifications

We may update these Terms at any time. Material changes will be communicated via the Service or email. Continued use after changes constitutes acceptance.

12. Infrastructure & Security Standards

We use authenticated access controls and encrypted service connections, and separately encrypt stored Google Analytics and Supabase OAuth tokens.

Network tests may intentionally inspect older protocols on a target; no scan certifies every system or connection as secure.

13. Third-Party Platform Comparisons

The Service may display comparison information about third-party platforms and their security features. This information is compiled from publicly available sources and is provided for informational purposes only. We make reasonable efforts to ensure accuracy, but platform features change frequently, and we cannot guarantee that comparison data reflects the most current state of any third-party product. SimplyScan is not affiliated with, endorsed by, or sponsored by any of the third-party platforms referenced in such comparisons.

14. Social Sign-In and Third-Party Authentication

SimplyScan offers social sign-in through Google and Apple purely as an authentication convenience. The availability of these sign-in methods does not imply any partnership, endorsement, sponsorship, or affiliation between SimplyScan (operated by Kraftwire Software) and Google LLC or Apple Inc.

Your use of Google or Apple Sign-In is also subject to those providers' respective terms and privacy policies. You are responsible for maintaining the security of the third-party account you use to sign in.

15. Contact

For questions about these Terms, contact us at simplyscan@kraftwire.com.

Google Analytics reports

You may connect only Analytics properties you are authorised to access. The optional Pro connection reads aggregate data for your selected landing page; it does not alter your Google Analytics settings. Google may limit or delay the available data. Reports exclude today and yesterday, omit days with fewer than 10 sessions and clearly mark limited coverage.

Comparisons with Chrome UX Report speed data show measures for the same two periods. They do not establish cause, statistical significance or a guaranteed conversion or revenue improvement. Google Analytics and CrUX use different visitor populations and may use different day boundaries. You remain responsible for interpreting the results and for your own site's consent and data collection practices. You can disconnect and delete imported data at any time; our Privacy Policy explains retention and revocation.

Reports, private repositories and local files

Repository scans can use public repositories or private repositories you authorise through GitHub.

History scanning continues in bounded batches across pinned branch and tag tips, with progress shown in the report; content that cannot be fetched or decoded, and deleted or unreachable commits, remain unverified.

The CLI, pre-commit hook, GitHub Action and MCP local-code tool send selected source files to SimplyScan for analysis, so use them only with code you are entitled to share.

Detected credential values are masked or withheld in report content; detection is not a guarantee that a secret is safe, and you remain responsible for rotating exposed credentials.

XSS checks identify supported source and response-policy patterns and do not establish that a running application is exploitable.

Bubble checks currently inspect publicly available evidence; Bubble export uploads and automatic import of private Bubble privacy rules are not currently available.

Authorised active tests

Active owner audits require a signed-in account, explicit consent and a current ownership check for each target origin.

Supported owner tests can send authentication, JWT, token-reuse, password-reset and test-record requests using the test accounts, endpoints and canaries you provide.

Owner TLS tests can attempt Heartbleed and ROBOT probes where the runtime supports them; unavailable transport or handshake evidence is reported as not tested.

You are responsible for authority to test, suitable test accounts and data, the effects of these requests on your service, and any resulting cleanup.

Database-port checks attempt bounded network connections to discovered public targets and do not prove that a database is safe or that authentication can be bypassed.

Monitoring, alerts and badges

Uptime monitoring requests checks from three configured regions and requires agreement from at least two independent regions before recording a confirmed up or down result.

A confirmed first-check outage or later outage can alert the account email and connected Slack, GitHub and Linear destinations; recoveries are also sent, subject to throttling and delivery retries.

Delivery is best effort and retries may produce duplicate integration messages; monitoring is not an emergency-response service.

Threat monitoring can send alerts based on enabled public checks and authorised telemetry, including Supabase authentication logs when connected.

A badge displays the last eligible full scan score and date alongside a cached light recheck of reachability, TLS validity and expiry, and selected security headers.

Badge views can trigger a light recheck at most once an hour per scan; this is not a continuous full security scan or a guarantee of security.

Breach readiness and speed estimates

Breach readiness combines public security and privacy contact signals with four confirmations you can save to your account.

SimplyScan cannot see whether your company actually operates a breach process or meets reporting duties, and the checklist is not legal advice.

Speed and revenue shows available public CrUX measurements and clearly labelled estimates from published research, not your own conversion or retention data, a prediction of revenue or financial advice.

The optional Google Analytics report is separate and uses the data and limitations described below and in our Privacy Policy.

Guest access and checkout details

A paid guest report uses a private access token stored in the purchasing browser; protect that browser and token, because a scan ID alone does not grant access.

Signing in with an eligible account can claim the purchase and report; complimentary rescans require the associated account.

The checkout notice states that Pro Reports are non-refundable digital products and that a typo in the submitted URL is not covered.