Trust Center
Last updated November 10, 2026
Everything about how we protect your data and run the service, in one place. Every page describes what our code does today.
- SecurityThe security controls in our code today, and how to report a problem.
- Privacy noticeWhat personal data we collect, why, and how to ask us to delete it.
- Data Processing AddendumGDPR, UK GDPR and CCPA terms for paying customers.
- SubprocessorsThe outside providers we use and the data each one gets.
- TermsThe rules for scans, accounts, paid plans and agency work.
- AboutWhat we do, who it is for, and the company behind it.
01Quick facts
- Every page and backend call uses HTTPS, with HSTS for one year, including subdomains.
- Row level security is on for the database tables in both backends.
- We do not ask for or store passwords. You sign in with Google or Lovable.
- API keys are stored as SHA-256 hashes. We show a new key one time only.
- Free scan limits use a salted hash of your IP address, not the address itself.
- You can delete your account in account settings.
- We do not hold SOC 2 or ISO 27001.
02Report a security issue
Email Mitchell@whywontai.com with "Security" in the subject line.