Privacy Policy

WebSentry ("we", "us", or "our") operates websentry.dev. This Privacy Policy explains how we collect, use, and protect your information when you use our website security scanning service.

By using WebSentry, you agree to the practices described in this policy.

Account information: When you register, we collect your name, email address, and hashed password.

Scan data: We store the URLs you submit for scanning, along with the scan results. This data is used to display your history and power monitoring alerts.

Usage data: We log scan activity (timestamps, API key used, result grades) for rate-limiting, billing accuracy, and abuse prevention.

Payment information: Payments are processed by Stripe. We do not store full credit card numbers, only a masked identifier and subscription status returned by Stripe.

Cookies & analytics: We use a session cookie (token) to keep you logged in. We also use Google Analytics and Google Ads measurement to understand site usage, Crisp for the support chat widget, and our own first-party analytics. These services may set their own cookies; see the cookie banner for your choices.

We use collected information to:

• Provide and operate the scanning and monitoring service
• Send email alerts when your monitored sites' security grade changes
• Process payments and manage subscriptions
• Enforce rate limits and prevent abuse
• Improve scan coverage and accuracy
• Respond to support requests
• Send product updates, changelogs, and occasional offers, only if you opted in at sign-up (you can unsubscribe at any time)

We do not sell your data to third parties. We do not use your scanned URLs or results for advertising.

We share data with the service providers required to operate the service:

• Cloudflare: hosting, database, storage, DDoS protection, Turnstile CAPTCHA
• Stripe: payment processing
• Resend: transactional email (alerts, receipts) and, where you opted in, product updates
• Google: analytics and advertising measurement
• Crisp: support chat

We may disclose data if required by law or to protect the rights and safety of users.

Scan results are retained so that report links keep working and monitoring history stays accurate; how much history you can browse in the dashboard depends on your plan. Account data is retained for as long as your account is active. When you delete your account or ask us to, we remove your personal data within 30 days, except where we are legally required to retain it.

We use HTTPS for all data in transit, hash passwords with a strong one-way key-derivation algorithm (PBKDF2 with per-user salts), and restrict database access to production systems only. No security system is perfect, if you discover a vulnerability, please contact us at security@websentry.dev.

You can:

• Request a copy of your data
• Request deletion of your account and associated data
• Update your email or name from the dashboard
• Unsubscribe from non-transactional emails at any time

To exercise these rights, contact us at privacy@websentry.dev.

WebSentry is not directed at children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

We may update this policy as the service evolves. If we make material changes, we will notify registered users by email. Continued use after changes constitutes acceptance of the updated policy.

Questions about this policy? Email us at privacy@websentry.dev or use the contact form.