Privacy policy

PwnMyVibeCode runs this website and the free site check on it. There's no account. The check never asks for your name or email address; the only place the site asks for an email is the optional stack alerts. This page lists everything PwnMyVibeCode handles, why, and for how long.

What is stored

• Check results. The address you submitted and the report it produced. Both are kept for 30 days so your share link works, then deleted automatically. Anyone you give the link to can open the report while it exists. Report pages are hidden from search engines.
• A rate limit counter. To stop abuse, checks and alert signups are counted per visitor using a one way hash of your IP address that changes every day, and alert signups per email address using the same kind of hash. The IP address itself is never stored, and the counters expire on their own.
• Server logs. The hosting provider keeps standard request logs (which include IP addresses) for a short period for security and debugging.
• Stack alerts. If you sign up for alerts, your email address and the tools you picked. You get an email with a link to confirm; if you don't confirm within 7 days of the latest confirmation email, the address is deleted. Once confirmed, it is used only to send advisories for your tools and links to change them. A record of which advisories were sent to you (so you never get one twice) is kept for 90 days. Unsubscribing, from the link in any alert or on the manage page, deletes your address and that record right away. If an alert bounces permanently or is marked as spam, the address is deleted too.
• Email. If you send an email to hello@pwnmyvibecode.com, the conversation is kept as long as it's needed to help you.

About the sites that get checked

A check reads what a site serves publicly to any visitor: response headers, cookies' names and settings and the page itself. When you ask for the full check, it looks for your verification tag on the home page or in the site's DNS, and once it finds it the check also reads the site's scripts and a short list of well known file paths. What a check reads is used only to build the report. Where a check finds something that looks like a secret, the report shows it masked, never in full. PwnMyVibeCode doesn't sell, publish or reuse what a check sees.

If you own a site and don't want it checked, email hello@pwnmyvibecode.com from an address at that domain and it will be blocked, including its subdomains.

Analytics

This site uses Google Analytics 4 to understand how it is used: which pages people visit, where they came from (like a search engine or a link), roughly where they are (country and city level), and what kind of device and browser they use. It sets first party cookies (named _ga and _ga_*) to tell visits apart.

A few actions are also recorded, with only the details listed here:

• a check started, whether it came from the form, a re-run or a link, and whether it was a full check
• a check finished: the grade, the score, the platform detected and how many issues of each severity
• a check failed, with the error code
• a copy button used (the share link, the fix list, a code snippet, the verification message or an alert prompt)
• switching between the plain and developer explanations
• opening the steps to verify a site, and whether verification passed and by which method (tag or DNS)
• opening a source on one of this site's incident write ups
• signing up for stack alerts: how many tools were picked and which page the form was on, never the address

Google is never sent the address you checked, anything you type, or anything from a report's evidence. Page addresses and titles are rebuilt from the path before anything is sent: query strings are dropped (except campaign tags like utm_source), report pages are recorded as just "Report", and addresses that aren't one of this site's pages are recorded as "Not found". The page you came from is cleaned the same way when it's on this site, and cut to just the site's name when it isn't. Google Analytics doesn't log or store IP addresses. Advertising features and Google signals are off, and nothing is used for ads.

Your choice. In the European Economic Area, the UK and Switzerland, analytics cookies are off until you say yes. Everywhere else they're on by default and you can say no. Without a yes, Google Analytics sets no cookies and only receives cookieless signals (for example that a page was viewed, with no identifier that links one visit to the next), which Google uses to estimate totals. The small notice at the bottom of the page records your choice in your browser. To change it later, clear this site's data in your browser and the notice will come back. You can also block Google Analytics everywhere with Google's opt out add on or a content blocker. Analytics data is kept for 14 months, then deleted by Google. Google's use is covered by its explanation of how it uses data from sites that use its services.

What stays in your browser

Your recent sites and their grades, the tools you picked on the alerts page, your preferred explanation style, your analytics choice and, if you verify a site, the random key your verification tag is made from are saved in your browser's local storage, and what changed since your last check of a site is kept in its session storage until you close the tab. They are never sent to this site, except the verification key, which goes to its server when you look for your tag or run a full check so it can confirm the tag, and is not stored. Clearing your browser data removes them.

Services that help run the site

• Railway hosts the site.
• Supabase stores reports, rate limit counters and alert subscriptions.
• Cloudflare handles DNS, and Cloudflare Turnstile may run a quick automated human check to keep bots out.
• Anthropic writes the short summary at the top of a report. It receives the list of findings for the checked site, never anything about you.
• Resend sends alert emails. It receives your address and the email's content.
• Google provides Google Analytics, as described above.

These providers may process data in the United States and other countries. PwnMyVibeCode doesn't sell or rent personal data, and doesn't share it with anyone except these providers, or where the law requires it.

Legal basis (for EEA and UK visitors)

• Running checks, rate limits, server logs and bot checks: PwnMyVibeCode's legitimate interest in providing a working, abuse free service.
• Stack alerts and analytics cookies: your consent, which you can withdraw at any time.

Your rights

Depending on where you live, you can ask to access, correct or delete personal data PwnMyVibeCode holds, object to or restrict how it's used, or withdraw consent. Because the site doesn't ask who you are, it usually isn't possible to link data to you, but every request gets as much help as it can. To delete a report early, email its share link to hello@pwnmyvibecode.com. You can also complain to your local data protection authority.

Children

The service isn't aimed at children under 16, and PwnMyVibeCode doesn't knowingly collect their data.

Security

Data is encrypted in transit, the database is only reachable from the site's server, and as little as possible is kept for as short a time as possible. No system is perfectly secure, though.

Changes and contact

If this policy changes, the date at the top of this page will be updated. Questions or requests go to hello@pwnmyvibecode.com. The rules for using the service are in the terms of use.