Privacy Policy

What we collect

• Account info: your email address, and if you sign in with Google, the basic profile info Google shares.
• Scan data: the repository URLs, server URLs, or config you submit for scanning, and the findings we generate from them.
• Abuse-prevention signals: a browser fingerprint (via the open-source FingerprintJS library) when you approve a device login, a hashed machine identifier from the CLI and Claude Code hook, and your IP address — used only to detect unusual multi-account signup patterns, never sold or used for advertising.
• Billing info: handled directly by Razorpay — we store your subscription status, not your card details.

Why we collect it

To run the service (scanning, showing you results, metering usage against your plan), to prevent abuse of the free tier, and to bill paid plans. We don't use your data for anything beyond operating Aevrin.

What we don't do

We don't sell your data. We don't use scan targets or findings for anything other than showing them back to you. We don't share machine/fingerprint signals outside of Aevrin's own abuse-prevention checks.

Source handling

Repository contents are cloned into temporary scan-worker storage and are not kept as part of scan history. Pasted configuration is processed by the scan job; durable history stores a fingerprinted label rather than the submitted configuration text. Findings, target identifiers, stages, and report data are retained in your account.

Automated analysis

The current scan pipeline uses the security tools identified in the product methodology. It does not send repositories or findings to an external language model to decide whether a vulnerability exists.

Retention

Plan screens show the configured history window. You may delete an individual scan or clear your scan history at any time. Automated retention pruning is not currently presented as a guarantee.

Your data

You can revoke API keys and delete individual scans or all scan history from your account. Full account deletion is not currently self-service; this page will be updated with the operator's request channel before that flow is offered.