Privacy notice
This notice covers vibe-scan.net and the VibeScan scanning service. See the scanner identification page if you are here because you saw VibeScan traffic in your own logs, or the terms of use for the rules on using the service.
What we process today
vibe-scan.net is hosted on Fly.io. Fly.io logs standard web-request metadata (IP address, timestamp, user agent) for every request to this site, as any hosting provider does, and is the processor of that data under the Fly.io privacy policy. The scan submission form and the email-capture form both use Cloudflare Turnstile to tell real visitors apart from bots; Cloudflare processes your IP address and the challenge outcome as part of that check, under the Cloudflare privacy policy.
When you submit a URL to be scanned, and if you enter an email address to see the full results, we process the categories of data listed below.
- Running your scan
- The URL you submit, the security findings we detect, and standard web-request metadata (IP address, timestamp, user agent) for the request that submitted it.
- Retention: Kept until you ask us to delete it — there is no automatic deletion job today. Email [email protected] to request deletion.
- Unlocking and emailing you the full report
- If you enter your email to see every finding (not just the free headline one), we store that email address, the IP address and timestamp it was submitted from, and a record of the exact consent wording you were shown. A signed cookie is also set in your browser so the unlocked report stays visible on return visits — see "Cookies" below. We also send a confirmation link to that address; once you click it, we email the full report to that address too. The confirmation link expires after 7 days.
- Retention: Kept until you ask us to delete it — there is no automatic deletion job today. Email [email protected] to request deletion.
- Optional product updates
- An optional checkbox lets you also consent to occasional security tips and product updates. If you tick it, we record that consent, including the exact wording you were shown and when.
- Retention: If you unsubscribe, we stop sending to you but keep a record that you withdrew (with a timestamp) as evidence we honored it -- that record is not deleted automatically. Email [email protected] to request deletion.
- Per-domain scan throttling (planned, not yet active)
- A short-lived per-target-domain counter to stop any one site being scanned too often.
- Retention: No longer than 30 days from creation. This is our policy commitment, not a number derived from a live job — this specific throttle has no live caller yet, so nothing is retained under it today. (Separate from the email-capture rate limiting below, which is active.)
- Email-capture abuse prevention
- To stop the email-capture form on scan results pages being used to flood a mailbox or spam this endpoint, we count attempts by IP address (stored as-is, not hashed) and by a hashed version of the email address you enter, each on an hourly and daily basis.
- Retention: These counters have no automatic expiry today. We're aware of this and it's tracked as a real gap, not an oversight.
- Aggregate service statistics (planned, not yet active)
- Anonymized statistics about scan volume and finding types, used to improve the product. No personal data would be included in these aggregates.
- Retention: Not yet active — our telemetry pipeline does not exist yet, so no data is collected under this purpose today.
Cookies
Once you unlock a report, we set one cookie (vs_unlock_…) so that report stays visible on later visits, for up to 30 days. It only controls access to a report you already asked to see — it does not track you across other sites, and we don't use it for advertising. We don't set any other cookies today.
Deletion and your rights
To ask what data we hold about you, or to request deletion, email [email protected]. We aim to respond within 30 days. Today this is handled manually — no automated self-service deletion flow exists yet.
Last updated: 2026-09-04