Privacy Policy

Effective Date: September 20, 2026 • Version 1.0

VulnWatch ("we", "our", or "us") is committed to protecting user privacy and ensuring transparent handling of audit data. This Privacy Policy details how we collect, process, store, and safeguard information when you use the VulnWatch Passive Vulnerability & Attack Surface Intelligence platform.

1. Information We Collect

A. Target Audit Inputs: When you initiate a security assessment, we record the target URL or hostname specified (e.g. hostnames, IP addresses, subdomains) to execute passive security checks.

B. Authentication & Profile Data: If you authenticate using Google Sign-In, we store your email address, full name, Google User ID, and profile image URL for user identification and scan history management.

C. Guest Device Identifiers: For unauthenticated guest sessions, we issue a random, anonymous guest device identifier cookie (guest_device_id) strictly to enforce free quota limits.

D. Technical Telemetry: Standard web server logs (IP address, browser user-agent, request timestamp) are collected for performance, abuse prevention, and rate-limiting purposes.

2. Data Usage & Processing Principles

We process collected information strictly for the following purposes:

  • Executing passive, non-intrusive security posture assessments against submitted target hosts.
  • Displaying historical audit reports, risk scores, and security findings in your personal dashboard.
  • Enforcing rate limits, guest quota boundaries, and anti-abuse safeguards.
  • Maintaining accurate user authentication and session security.

We do NOT perform active intrusive exploits, port sweeps, or brute-force attacks. All audit data is generated through public standards-compliant passive inspection (DNS queries, TLS handshakes, HTTP response header inspection, Certificate Transparency logs).

3. Data Storage & Retention

Scan results and audit history are securely stored in our encrypted production database. Audit reports associated with guest sessions may be subject to automated cleanup after 30 days. Authenticated users retain full control over their scan history and can delete specific audit logs via their account dashboard.

4. Cookies & Local Storage

VulnWatch uses strictly necessary cookies and local storage tokens to operate essential functions:

  • session: Encrypted Flask session cookie for authentication and state.
  • guest_device_id: Unique random UUID cookie for tracking guest quota.
  • vw_theme / wg-theme: Browser local storage preference for light/dark display theme.

5. Third-Party Services

We integrate with Google OAuth 2.0 strictly for user authentication. We do not sell, rent, or trade your personal information or audit findings to third-party advertisers or data brokers.

6. Your Rights & Data Deletion

You have the right to access, export, or request permanent deletion of your audit data and account credentials at any time. You can clear your account data directly from the Settings page or by contacting our team.

7. Contact Us

If you have questions regarding this Privacy Policy or security operations, please reach out via our official repository or contact security support at [email protected].