Privacy policy

The short version

• We don't keep the files you scan. They're scanned in memory and discarded when the result is returned.
• We keep your account details, how many scans you've used, and a fingerprint of each tool you scan so we can tell you if it changes.
• We don't sell your data, and we don't use advertising or analytics trackers.
• You can delete your Ryzek data from your account page at any time.
• The leaderboard is opt-in. If you join it, only the display name you choose, your points and your region are shown.

Who we are

Ryzek ("we", "us") provides the scanner at ryzek.dev. For anything in this policy, contact hello@ryzek.dev.

What we collect

Your account

When you create an account, our sign-in provider collects your name, email address and profile image, and — if you sign in with Google, Apple or Facebook — the identifier that provider gives us. We use this to let you sign in and to contact you about your account.

Scanning

When you scan, the text of the files you add is sent to our scanner over an encrypted connection and processed in memory. File contents are not written to any database or log. For binary files, only the file size and its first 16 bytes are sent; the file itself stays on your device.

We store:

• How many scans you've used each month, to apply your plan's allowance.
• For each tool you scan, a fingerprint made of cryptographic hashes and the tool's permission labels (for example network:read). This is what lets Ryzek tell you when a tool changes. We don't store tool names or descriptions in readable form. You can clear this history at any time.
• Totals of how often each rule matched, with no link to any account.

Messages you send us

If you use the contact form, we receive your name, email address and message by email. It isn't stored in our database. To limit abuse, we keep a count of messages per hour keyed by a salted hash of your IP address, and delete those counts after two days.

Plan interest

If you ask to hear when a paid plan opens, we record which plan, so we can email you.

The leaderboard

The leaderboard is opt-in. If you choose a display name and switch the board on, that name, your points for the month and your region are shown publicly. Your email address, your sign-in name and what you scanned are never shown.

To score scans fairly, we keep, until the month is over and then delete: one hash per upload (a fingerprint calculated from the hashes of the files, not the files themselves), a hash of each finding that has scored (calculated from the rule and the text it flagged — the text itself isn't kept), and the points each upload scored. We also keep the region your first scan of each month came from, one of eight broad regions worked out from the country of your connection; we don't keep your IP address or country. Monthly totals of scans and of people scanning are shown publicly, without names. You can take your name off the board at any time from your account page; it disappears within a few minutes.

Spotlight write-ups

If you send a write-up for the leaderboard page, we store what you wrote, your star rating and when you sent it. The Ryzek team reads it before deciding whether to publish it under your display name, and we email ourselves a notice that it's waiting. Unpublished write-ups are visible only to you and to us.

Technical data

Like any website, our hosting provider processes IP addresses and request details to deliver pages and protect the service from attacks.

Cookies

We use only the cookies needed for sign-in to work. There are no advertising or analytics cookies.

Who processes data for us

• Clerk — account sign-in and profile management.
• Cloudflare — hosting, the database that stores the data described above, email delivery for the contact form, and security.
• Google, Apple or Facebook — only if you choose to sign in with them.

These providers may process data outside Australia. We use them only for the purposes described here.

How long we keep it

Account details, usage counts, tool fingerprints, your leaderboard name and write-ups are kept while your account exists. Upload hashes used to count distinct scans are deleted once their month is over. Deleting your Ryzek data from your account page removes usage counts, plan interest, tool fingerprints, your leaderboard name and your write-ups straight away; deleting your sign-in account removes your account details from our sign-in provider. Rate-limit counts are deleted after two days.

Your choices and rights

You can see your usage and clear your tool history on your account page, delete your Ryzek data there, and delete your sign-in account from the profile section. You can also ask us for a copy of your data, to correct it, or to delete it by emailing hello@ryzek.dev. If you're unhappy with how we've handled your information, contact us first; in Australia you can also complain to the Office of the Australian Information Commissioner.

Security

Connections are encrypted, access to stored data is restricted, and sign-in is handled by a dedicated provider rather than passwords stored by us. No system is perfectly secure; if you find a vulnerability, please report it.

Changes

If we change this policy in a way that matters, we'll update the date above and, for significant changes, tell account holders by email.