Get the scan $1 $5

Privacy Policy.

Last updated: October 19, 2026

ClearanceHQ ("we", "us"), collects the minimum data needed to run your scan and deliver your report. Data controller contact: clearancehq@mail.grokbot.com.

1. What we collect

  • Order details: your email address (entered at checkout) and the Targets you submit (URL and/or GitHub repository).
  • Verification records: whether your URL and repository passed ownership verification, the GitHub App installation ID for your repository, and your confirmation, when you order, that you are authorized and accept our Terms.
  • Consent record: when you check out, we record the version of the Terms you accepted, the date and time, your order ID, the ownership verification method, and your IP address. The IP address is deleted after 90 days; the rest of the record is deleted after 1 year.
  • Payment confirmation: payment status and the Stripe checkout reference. Stripe handles your card; we never see or store your card number.
  • Scan results: findings, file paths and redacted evidence used to build your Report. Discovered secrets are never stored in full: only a short redacted prefix and a one-way fingerprint (a truncated SHA-256 hash) used to match the same secret on your re-scan.
  • Free checks and abuse prevention: the URL you check and your IP address, used for rate limiting and abuse prevention.
  • Cookieless site analytics: to see which pages are used and where visitors come from, each page view records only the date, the page path, the website you came from (its domain name only, never the full link), any campaign tags in the link (utm_source, utm_medium, utm_campaign), whether the device is a phone, tablet or computer, and your country as reported by our host, Cloudflare. We also count, without any link to you, how many free checks, checkouts, payments and delivered reports happen each day. Analytics use no cookies, no local storage and no visitor ID, do not store your IP address or full browser details, are run by us (no third-party trackers or ad networks), and are only ever looked at as totals. If your browser sends Do Not Track or Global Privacy Control, no page view is recorded.

2. What we don't keep

  • Your source code: repositories are cloned to temporary storage on our scan machine only for the duration of the scan and are deleted automatically when the scan finishes or fails. An automatic cleanup also removes any leftover copy (for example after a crash) within 24 hours. We don't keep a copy, and we don't use your code to train AI models.
  • Database contents: when a public database key is tested, we only check whether data is reachable and count visible rows; we don't keep row contents.
  • Tracking cookies or profiles: we don't set analytics or advertising cookies, don't track you across sites, and don't build visitor profiles. Analytics never store IP addresses.
  • GitHub tokens: when you sign in with GitHub, we use a short-lived token once to confirm you have push or admin access to the repository, then revoke it. For the scan, our machine requests a read-only installation token (valid at most one hour) and revokes it right after cloning. We never store GitHub tokens.

3. GitHub App access

Our GitHub App asks only for Contents: read-only and Metadata: read-only, has no webhooks and cannot write to your repository. Install it on only the repo you want scanned. We keep the installation ID (not a secret) so your free re-scan works and delete it with your report after 30 days. You can uninstall the app at any time in GitHub under Settings > Applications > Installed GitHub Apps; we link to it from your report.

4. How we use your data

Only to verify your authorization, take payment, run your scan and re-scan, host your private report link, prevent abuse, and meet legal and tax obligations. We don't sell your data, share your findings, or send marketing emails. Reports are delivered as a private, unguessable link on your order page; we don't email your findings.

5. Retention

  • Report contents, findings and GitHub installation IDs: deleted 30 days after the report is generated.
  • Free-check records (URL and IP address): deleted after 30 days. Short-term rate-limit counters: deleted after 24 hours.
  • Site analytics: individual page-view and event records (described in section 1) are deleted after 90 days; only daily totals (for example "120 page views from reddit.com on October 20") are kept after that.
  • Consent records (Terms version, date and time, order ID, verification method): kept for 1 year. The IP address in a consent record is deleted after 90 days.
  • Temporary repository copies: deleted when the scan ends; any leftover copy is removed automatically within 24 hours, even after a crash.
  • Basic order records (email, Targets, payment reference, status): kept as long as needed for tax, accounting, fraud prevention and legal purposes for 1 year after purchase, after which we delete or anonymize your email address, Targets and Stripe checkout reference. Stripe keeps its own payment and tax records under its own policies. You can ask us to delete them sooner where the law allows.

6. Service providers

  • Cloudflare: website hosting and database (including our own cookieless analytics totals).
  • Stripe: payment processing.
  • GitHub: sign-in check and read-only repository access through our GitHub App.
  • Scan machine: scans run on a cloud machine we operate.

7. Your rights

Depending on where you live (for example under the GDPR, UK GDPR or California law), you may have the right to access, correct or delete your personal data. To use these rights or delete your report before the 30-day limit, email clearancehq@mail.grokbot.com from the address you used to order.

8. Children

The Service is only for people aged 21 or older. We do not knowingly collect data from anyone under 21; if you believe we have, email clearancehq@mail.grokbot.com and we will delete it.

9. Changes

If we change how we handle data, we'll update this page and the "Last updated" date.