legal
privacy policy.
effective 2026-07-16 · plain-language v1
1. What we collect
Account data (email, GitHub profile basics via OAuth), run configurations (target URL, chosen personas, settings), run outputs (findings, reports, action logs), billing status via Stripe (we never see your card number), and basic operational logs. Anonymous runs are keyed to a salted hash of your IP for the daily quota — not to an identity.
2. Where it lives
Application data is stored in Supabase (Postgres, Frankfurt region, EU). The test engine executes on Fly.io in Frankfurt. The website runs on Cloudflare. Stored site credentials and BYOK API keys are encrypted at rest with AES-256-GCM before they touch the database.
3. AI providers
To generate findings, page content and screenshots from the site under test are sent to the AI provider used by the run — Google (Gemini) or Anthropic (Claude). On the hosted platform we use a paid Gemini tier configured for no-training. If you bring your own key, requests are billed to and governed by your own provider agreement. Avoid pointing runs at pages containing personal data you would not want processed by an AI provider.
4. Secret redaction
The engine strips credential-shaped strings (API keys, tokens, private keys, database URLs) from evidence, console output, and transcripts before they reach disk, reports, or the AI provider. This is defense-in-depth, not a promise that no sensitive string can ever appear in a report — review shared reports before sharing.
5. Sharing & retention
Reports are private to your account unless you create a share link (or the run was anonymous — those are link-accessible by design). You can delete runs from the dashboard; deletion removes the run and its event history. If you cancel Pro, your data stays for 30 days and is deleted after that unless you resubscribe.
6. Cookies
We use session cookies for authentication (Supabase Auth). No advertising trackers.
7. Your rights
You can export your reports (HTML/Markdown/JSON) at any time, delete individual runs yourself, and request full account deletion at support@breakit.dev. EU users: data is processed in the EU; you have the usual GDPR rights of access, rectification, and erasure.
8. Changes
Material changes to this policy will be announced on this page with a new effective date.
Questions: support@breakit.dev. See also our terms of service.