Privacy notice

Last updated: 16 September 2026

1. What we hold about developer accounts

• The email address you register, and a bcrypt hash of your password.
• Your TOTP secret, so two-factor sign-in works.
• Your API key, stored as a hash — we cannot read it back to you.
• Request counts against your monthly quota.
• Sign-in events: time, outcome and source address, kept for abuse handling.

2. What we publish about attackers, and what we never publish

The intelligence this service sells is derived from traffic that attacks our own sensors. Source addresses are masked to /24 in anything published. Payload bodies, ISP attribution and destination ports are never published — an exploit body is a working exploit, and we are not in the business of distributing one.

3. Behavioural signals on this site

To stop automated abuse of the portal — credential stuffing, scripted sign-ups, quota farming — we may measure how a browser interacts with these pages: the shape and timing of pointer movement, the intervals between keystrokes (never which keys, and never the contents of any field), tap and scroll behaviour, and the cadence of requests.

What is stored is derived features, not the raw movement track: measurements such as how direct a path was and how regular its timing was. Your address and browser string are stored as salted hashes, not in clear. These signals are used to decide whether a session is automated and for nothing else — not for advertising, not for profiling you as a customer, and they are not sold or shared with anyone.

The same measurements also train the automation-detection model that protects this service. If a session is judged automated, it may be challenged again or temporarily restricted; restrictions are time-limited and expire on their own. Retention for these signals is 30 days.

We are telling you this because we think a security vendor that quietly profiled its own customers would deserve to lose them. If you would rather your sessions were excluded, email us and we will exempt your account.

4. Cookies

A session cookie to keep you signed in, and a short-lived cookie recording that you passed the bot challenge. No advertising or cross-site cookies.

5. Sharing

• Cloudflare — traffic passes through it, so it sees your address.
• Email provider — for account and verification mail.
• Legal obligation — if we are required to.

We do not sell personal data.

6. Your rights

You can ask for a copy of what we hold, ask for it to be corrected, ask for your account and its data to be deleted, or object to the behavioural measurement in section 3. Write to the address on the contact page.

7. Changes

If this notice changes materially we will say so on the portal rather than quietly reissuing the page.