Privacy Policy

buckingfugs (“we,” “us”) is a free security scanner. This policy explains what we collect when you use buckingfugs.com(the “Service”) and what we do with it. We built the Service to be privacy-respecting by default: the scanner needs no account and sets no advertising trackers. Accounts exist only for optional live monitoring, and even then we collect the minimum described below.

What we collect

Scan data

When you run a scan we process the domain you submit and the public information we look up about it (DNS records and public HTTP responses). We store a minimal record of each scan — the domain, its score and grade, and how long the scan took. A scan itself is anonymous: we do notstore your IP address, your browser's user-agent, or tie the scan to any identity.

Analytics

We keep first-party, cookieless analytics to understand which pages get used. For each pageview we record only the page path and, if you arrived from another site, that external referrer. We do not set analytics cookies, log IP addresses, or build any device fingerprint or visitor profile.

Accounts & monitoring

You only need an account to use live monitoring — the one-off scanner works signed out. If you sign up, we store your email address and, through our authentication provider Supabase, your sign-in method (a passwordless magic link or Google sign-in) and any two-factor method you turn on. Sign-in is passwordless, so we never hold a password for you.

When you put a domain under monitoring we store the domain, the plan you're on and its status, proof that you verified control of the domain (a token you place in DNS or a file), and the scheduling data that runs the re-scans — when it was last scanned, its last score, and when we last emailed you. If you invite teammates to view your domains, we store their email addresses to share access. Unlike anonymous scans, these records and the alert emails are tied to your account.

Payments (paid monitoring)

The security scan and its fixes are free. Optional paid monitoring plans are billed through Stripe, our payment processor. Stripe collects and handles your payment details (such as your card number) under its own privacy policy — we never see or store your full card number. We store your Stripe customer and subscription identifiers and your plan status to run the subscription, plus non-sensitive billing records such as the plan, amount, and date.

What we do not do

• No passwords — sign-in is passwordless, so there's none of yours to leak.
• No advertising trackers, third-party analytics pixels, or cross-site cookies.
• No selling, renting, or trading of your data. Ever.
• No IP-address or user-agent logging for scans or analytics.

Cookies

We don't use cookies for tracking or analytics. During a payment, Stripe may set cookies within its own payment components to prevent fraud and function correctly; those are governed by Stripe's policy.

Service providers

We rely on a small number of processors to run the Service:

• Stripe — payment processing for paid monitoring subscriptions. Privacy policy.
• Supabase — our database and authentication provider: it stores the records described above and manages account sign-in. Privacy policy.
• Our hosting provider — serves the site and may process standard server request logs on our behalf.

How long we keep it

We keep anonymous scan and analytics records only as long as they're useful for operating and improving the Service, and we aggregate or delete older records periodically — they contain no personal identifiers, so they can't be tied back to an individual. Account data (your email, monitored domains, and billing status) is kept while your account is active; delete your account and we remove it.

Your rights

Depending on where you live (for example under GDPR or CCPA), you may have rights to access, correct, or delete personal data we hold about you. If you don't have an account, we typically hold no personal data about you. If you do, you can review and delete it from your account settings — deleting your account removes your email, monitored domains, and billing records — or email us at hello@buckingfugs.comand we'll help.

Children

The Service isn't directed at children under 13, and we don't knowingly collect information from them.

Changes to this policy

We may update this policy as the Service evolves. When we do, we'll revise the “Last updated” date above. Material changes will be made clear on this page.

Contact

Questions about privacy? Email hello@buckingfugs.com.