Privacy Policy

Data controller: Richmond Capital Holdings Ltd, trading as SealMyApp. Registered in England and Wales, company number 17137348. Registered office: Halsey House, 18a Milner Street, London SW3 2PU. Contact: hello@sealmyapp.com.

The short version

• We don't store data from the apps we scan. If we confirm a database table is publicly readable, we read at most one row and discard it immediately. We keep only findings — for example “table X is readable; columns: a, b, c”. Secret keys we detect are masked before anything is stored.
• We only scan apps whose owners have verified control of the domain.
• We don't sell personal data.

What we collect about you

• Scan records: the domain you submit, the verification token, the time of the scan, and the findings (redacted descriptions, severity and score).
• Abuse prevention: a one-way hash of your IP address, used for rate limiting and kept for a short period (up to 2 days).
• Payments: handled by Stripe. We receive your email address, a customer ID and payment status; we never see your full card details.
• Email: if you give your email address on the scan form, buy a Fix Pack or Watchdog, or subscribe to the newsletter, we use it to send your report, receipts, alerts or the newsletter. Transactional emails go via Resend. Newsletter sign-ups are stored by us and the newsletter is sent via Resend; we use double opt-in (you confirm by clicking a link in an email first), and you can unsubscribe any time from the link in any issue. If you give your email on the scan form and your report found issues, we may send you one follow-up email about that report; you can opt out on the form or from the link in that email, and we never send more than one per scan.

Processors we use

Netlify (hosting and data storage), Cloudflare (DNS and email forwarding), Stripe (payments), Anthropic (generating fix suggestions from redacted findings — no data from your app's users is sent), Resend (transactional email and the newsletter). Some of these providers may process data outside the UK under appropriate safeguards.

How long we keep data

Scan findings and reports: 12 months from the last scan, or sooner if you ask us to delete them. Rate-limiting data: up to 2 days. Payment and invoice records: as long as UK law requires (normally 6 years).

Your rights

Under UK GDPR you can ask for access to, correction of, or deletion of your personal data, and you can complain to the Information Commissioner's Office (ico.org.uk). Contact hello@sealmyapp.com.

Cookies

This site sets no tracking or advertising cookies. Stripe Checkout sets its own cookies on Stripe's pages. The newsletter sign-up form is our own and sets no cookies.