Privacy

What we receive

To run a check we receive the address you typed, the permission flag, and your IP address for the rate limit. If you choose those modes, we also receive an API path list or a Supabase or Firebase key.

What we do not keep

We do not store page bodies, API response bodies, or the keys you paste. A key is used for the read-only check and then dropped. It is not written into the share link, the badge, the downloaded fix file, or our logs. Do not put a key in the address field.

A share link is an encoded URL. We do not keep a copy on a server. It holds the score, the grade, a short summary, and headlines. It does not hold keys or response bodies.

How long

IP addresses are kept for up to 1 hour, and only for rate limiting. They are not a scan report.

A finished check writes one usage record, kept for 180 days: the time, the site hostname, the score, the grade, the language, and the country. A verified paid report is stored so its link keeps working. The email from Stripe is used only to send that link. The record does not include the IP address, the browser, or the path and query string.

If you use the contact form, we store your name, email, topic, and message in a private store. We use that only to reply. We do not show an email address on the site.

Cookies and analytics

Your language choice is a cookie named appvitals-lang. English is the default until you pick Korean.

Vercel Web Analytics counts page views without cookies. It does not build a profile of you. Cloudflare Web Analytics does the same when it is on. If the bot check is on, Cloudflare checks that the request came from a browser. We do not store that check.

Contact

Privacy questions go through the contact form. We do not publish an email address.