StackWatcher

Privacy Policy

Last updated 10 November 2026

StackWatcher (“the service”, “we”) checks code repositories for leaked secrets, vulnerable dependencies, outdated plugins and risky configuration. This policy explains what we collect, why, and what you can do about it. The service is run by Alex Hyslop in the United Kingdom, who is the data controller. Contact: contact@ahyslop.co.uk.

What we collect

  • Account details. Your name, email address and profile picture, from the form you fill in or from Google or GitHub when you sign in with them. If you use a password, we store only a salted hash of it.
  • GitHub access. If you connect GitHub, we store your GitHub username and an access token, encrypted, so we can list and download the repositories you choose to scan. The token is read-only: it cannot change your code or settings, it only works on the repositories you pick on GitHub, and it expires after 8 hours. We don’t keep a refresh token, so when it expires you reconnect. If your organisation connects GitHub through our GitHub App instead, we store only which GitHub account it was installed on and whether it covers all or selected repositories; the read-only tokens we use for scans last one hour and are never saved.
  • Projects and scan results. The repositories you add, and each scan’s results: the issues found, the file paths and short code excerpts around each issue, the technologies detected and the package versions involved. Excerpts are not kept for leaked secrets.
  • Technical data. Our hosting provider records standard request logs (such as IP address, browser and time) for security and troubleshooting. We record failed log-in attempts against an email address for 24 hours to block password guessing.

Your code

When you run a scan we download the repository, check it in memory and then discard it. We don’t keep a copy of your code beyond the excerpts in the scan results described above.

How we use it

  • To sign you in, run the scans you ask for, and show you your projects and results.
  • To keep the service secure and working, and to work out costs, such as how many AI tokens a scan used.

We don’t sell your data, use it for advertising, or use your code to train AI models. Under UK GDPR our legal basis is performing our agreement with you (providing the service), and our legitimate interest in keeping it secure.

Google user data

When you sign in with Google we receive only your name, email address and profile picture, and use them only to create and identify your account. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Who we share it with

These sub-processors help us run the service. Each receives only what it needs, under a contract that requires it to protect the data:

  • Vercel Inc. hosts the application, runs scans and keeps request logs. The servers we use are in the EU/UK.
  • Neon Inc. hosts the database holding your account, organisations, projects, scan results and audit log, in the EU/UK.
  • GitHub Inc. (Microsoft) handles GitHub sign-in and the GitHub App, and serves the repositories you ask us to scan.
  • Resend Inc. sends our emails (invitations, password resets, email address confirmations and alerts) from its EU region, so it receives the recipient’s email address, name and the message, and keeps delivery logs for a limited period.
  • Stripe handles billing for paid plans. Card details go straight to Stripe; we never see or store them.
  • Anthropic PBC (Claude API) receives a selection of the most security-relevant source files when an AI code review runs. Committed .env files are never sent. Anthropic doesn’t use API data to train its models.
  • Cloudflare Inc. (public DNS resolver) receives the domain names you check, to test whether DNSSEC is turned on. It doesn’t receive your identity.
  • Google, when you choose to sign in with Google.

We also look up public data: OSV.dev and WordPress.org receive package, plugin and theme names and versions (not your code or identity) to find known vulnerabilities and updates.

GitHub, Resend, Stripe, Anthropic, Cloudflare and Google may process data in the United States. Those transfers rely on safeguards such as the UK–US data bridge or standard contractual clauses in each provider’s data processing terms. We may also disclose data if the law requires it. Our security page explains how we protect it.

Cookies

We use one essential cookie to keep you logged in for up to 30 days, and short-lived cookies during Google or GitHub sign-in. We also store small preferences, such as grid or list view, in your browser. There are no analytics or advertising cookies.

How long we keep it

We keep your account, projects and scan results until you delete them or ask us to delete your account. Deleting a project deletes its scans straight away. Disconnecting GitHub deletes the stored token. Password reset and email confirmation links stop working after an hour or a day, and we delete our record of them after 7 days. Request logs are kept by our hosting provider for a limited period.

Your rights

You can ask to access, correct, export or delete your data, or object to how we use it, by emailing contact@ahyslop.co.uk. You can also revoke our access at any time from your GitHub or Google account settings. If you’re unhappy with how we handle your data you can complain to the UK Information Commissioner’s Office (ico.org.uk).

Security

Passwords are hashed, GitHub tokens are encrypted, connections use HTTPS, and each account can only see its own projects. No system is perfectly secure, so please tell us at once if you think something is wrong.

Changes

If we change this policy we’ll update the date above, and tell you about significant changes. See also our Terms of Service.