Privacy notice
What happens to your code, your email and your report, in plain words. Short version: we read your code to check it, keep only the findings, and never sell or share anything.
1Who we are
Redproof is operated by Hristijan Mijalkov, an individual based in Kočani, North Macedonia ("we"). We decide how your personal data is used, so we are the controller of it.
Contact for anything about your data: hello@redproof.dev. We have not appointed a data protection officer because the law does not require one for a business of our size; write to the address above instead.
2What we collect and why
Code you submit. When you paste a GitHub link we download the repository into memory to scan it. When you upload a zip we store it until the review of your scan is finished, at most 7 days, so a paid review can read it again; then it is deleted. We never run your code. Legal basis: performing the service you asked for (GDPR Art. 6(1)(b)).
Findings. We keep the results of the scan: file names, line numbers, short excerpts of code around each problem with secrets masked, and the score. They make up your report. Legal basis: performing the service.
Your email address, if you give it. We use it to send your report link and messages about your report or order. We send marketing only if you opt in, and you can opt out with one click. Legal basis: performing the service; consent for marketing.
Payment details. Our payment provider handles payments as merchant of record. We receive your name, email, country, what you bought and the amount, never your card details. Legal basis: performing the contract and our legal duty to keep accounting records.
Technical data. Our servers log requests (IP address, time, page requested, browser type) to keep the service secure and to fix errors. These logs are deleted after 30 days. Legal basis: our legitimate interest in running a secure service.
We use no advertising or tracking cookies. The site stores a sign-in cookie only for our own admin staff.
3AI review
For paid reports, parts of your code are sent to Anthropic's API (Claude) for an AI review. Secrets we detect are masked before anything is sent. Anthropic does not use data sent through its API to train its models by default and processes it under its commercial terms and data processing addendum.
5How long we keep it
Uploaded zips: until the review is finished, at most 7 days. Downloaded GitHub code: only in memory during the scan.
Reports and findings: for 12 months after your last activity, so you can re-scan and compare, unless you ask us to delete them sooner.
Order and invoice records: as long as accounting and tax law requires.
Server logs: 30 days.
6Your rights
You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable format. Where we rely on consent you can withdraw it at any time. Email hello@redproof.dev; we answer within one month.
If you think we handle your data unlawfully, you can complain to the Agency for Personal Data Protection of North Macedonia (dzlp.mk) or, if you live in the EU, to the data protection authority in your country.
7How we protect it
Connections are encrypted, access to stored data is limited to the people who need it for your report, secrets in your code are masked in everything we store, and reports use long random links that cannot be guessed.
8Changes
If we change this notice in a way that matters, we update the date at the top and, if you gave us your email, tell you before the change applies.