Privacy Policy

Draft: this document is still under legal review and may change. Details shown as [missing: …] are not filled in yet.

Last updated: 2026-10-03

Who is responsible

Cloud Manager SRL (Trade Register J2022002716130, CUI RO46566106), with its registered office at Str. S3, No. 16, Năvodari, Constanța County, Romania ("we"), is the controller of the personal data described here. Contact us about privacy at catalin@scrutyn.com. We are based in the European Union, so the EU General Data Protection Regulation (GDPR) applies to what we do, wherever you are. If you live in the United States, the US state privacy notice below also applies to you.

When a Team account uses Scrutyn, we process its members' data on the team's behalf as a processor, under our Data Processing Agreement.

What this notice covers today

Scrutyn is in private beta. Today this website is a set of static pages and a form to request beta access; accounts, the registry and the dashboard are not open to the public yet.

Beta access requests

What we collect. When you request beta access we receive:

  • your email address (required);
  • your name, your company and what you would use Scrutyn for, if you give them;
  • your acknowledgement that you have read this notice;
  • whether you also asked for product updates;
  • when you sent the request, and how many times.

To stop abuse of the form, we also use your IP address and your email address in hashed form (a keyed hash, with a secret key of ours), only as keys for rate limits. The hashed IP address is not stored with your request.

Why, and on what legal basis. We use this data to answer your request, to decide whether and when to offer you access, and to contact you about it. The legal bases are the steps you ask us to take before a possible contract (Art. 6(1)(b)) and our legitimate interest in running an orderly beta (Art. 6(1)(f)). Ticking "I have read the Privacy Notice" confirms that you have seen this notice; it is not consent, and the form needs it only so that you know how your request is handled.

Emails about your request. We send you one email to confirm that we received your first request. If very many requests arrive within an hour, we may skip that email; your request is stored all the same. It does not give you access to the beta. We also send ourselves a notification with your request, so that we can answer it. Both emails go through Postmark. A request does not guarantee access, and we may decline or close requests.

Automated submissions. If the form's hidden anti-spam field is filled in, we keep the request marked as suspected spam for 30 days, send no email about it, and then delete it.

Product updates

Only if you tick "Send me Scrutyn product updates, news and offers. I can unsubscribe at any time." on the form. The box is unticked by default, and your beta request never depends on it.

  • Legal basis: your consent (Art. 6(1)(a)), which you can withdraw at any time.
  • Double opt-in: we first send you an email asking you to confirm, with a link that works for 7 days. We send you no product updates unless you confirm. If very many requests arrive within an hour, we may not send that email; your request then stays unconfirmed, and you can ask again later with the form.
  • What we record: the wording you agreed to and its version, when you asked, where you asked (the beta access form), when you confirmed, and when you unsubscribed.
  • Unsubscribing: every update has an unsubscribe link, and you can also email us. When you unsubscribe, we keep your address on a suppression list, so that we never send you updates again by mistake; that is our legitimate interest in respecting your choice (Art. 6(1)(f)). A later beta request never signs you up again: that needs a new, explicit opt-in and a new confirmation. Unsubscribing from updates does not stop the emails about your beta request itself.

This website

This website is a set of static pages, hosted by RareCloud and served through Cloudflare, which protect and deliver it. To do that they process your IP address and the details of each request (such as the page, the time and your browser's User-Agent). This website runs no analytics. It loads advertising tags only if you accept them, as our Cookie Policy explains.

What we collect once the Service is open

Data Examples Where it comes from
Account email address, name if you give one, and, once GitHub sign-in launches, GitHub user ID and username; team and role you; GitHub only once sign-in launches
Devices and tokens device name, a SHA-256 hash of each device token (never the token itself), when it was created and last seen, the package manager last used your devices, our registry
Install ledger for each metadata request and download: device, package manager (from the User-Agent), package name, version, verdict, time, and the optional project name in your registry URL your package managers
Weekly digest counts account-linked totals by UTC day, ecosystem, action and finite refusal reason; no device, user, package, version or exact event timestamp ledger rows removed by Free-plan retention
Digest preferences and run state your digest setting, account-linked frozen weekly totals and temporary user identifiers used to page through recipients your settings, account membership and ledger counts
Policies and exceptions quarantine settings, exceptions and the reasons you give, approvals you, your team admins
Billing plan, subscription status, country, and the name and email Paddle gives us. We never receive your card details Paddle
Support your messages and our replies you
Technical logs IP address, request path (with tokens removed), time, status code, User-Agent your browser and devices
Website analytics pages visited (without query strings or identifiers), referring site (domain only), browser language, screen size, country derived from the IP address your browser
Ad measurement, only with your consent ad click IDs, and a hashed email address when you buy your browser, Paddle

We do not ask for sensitive personal data. The package code we scan comes from public registries, not from you.

Purpose Data Legal basis under the GDPR
Answer beta access requests and manage access to the beta beta access requests steps you ask us to take before a contract, and our legitimate interest (Art. 6(1)(b) and (f))
Prevent abuse of the beta access form hashed IP and email addresses, used as rate-limit keys our legitimate interest in keeping the form usable (Art. 6(1)(f))
Send product updates, news and offers email address, consent record your consent (Art. 6(1)(a)), which you can withdraw at any time
Provide the registry, scanning, quarantine, ledger and recall alerts account, devices, install ledger, policies our contract with you (Art. 6(1)(b))
Send transactional email: sign-in links, recall and security alerts, billing notices account our contract with you (Art. 6(1)(b))
Send the weekly digest, which you can turn off account, install ledger, weekly digest counts our legitimate interest in keeping you informed about the service you use (Art. 6(1)(f))
Billing and taxes billing our contract and our legal obligations (Art. 6(1)(b) and (c))
Secure the Service, prevent abuse, enforce device limits, investigate incidents technical logs, devices our legitimate interest in running a secure service (Art. 6(1)(f))
Understand how the website is used, in aggregate, once analytics runs website analytics our legitimate interest (Art. 6(1)(f)); no cookies, no cross-site tracking
Measure which ads bring people to our website, and later which lead to sign-ups and purchases ad measurement your consent (Art. 6(1)(a)), which you can withdraw at any time
Answer support requests support our contract with you or our legitimate interest

The install ledger

The ledger is the core of Scrutyn. It lets you see what your AI coding agents installed, and it lets us warn you if something you installed turns out to be malicious. It records package names and versions, not the contents of your projects. Project names come only from the optional segment you add to your registry URL. We never send ledger data to the AI models that help us analyse packages, and we never use it for advertising.

Ledger entries are kept for 7 days on the Free plan and 1 year on Pro and Team. The weekly digest does not extend the Free plan's seven-day raw-ledger cutoff.

For the Service release, deleting Free-plan ledger rows will preserve only account-linked counts grouped by UTC day, ecosystem, action and a finite refusal-reason code. These counts contain no device or user identifier, package name, version, project name or exact event timestamp. They remain account data, not anonymized data. Their expiry is the end of the activity's UTC week plus 14 days, at most 21 days from the activity; bounded maintenance removes expired buckets independently of email delivery. Account purge removes that account's buckets, and account exports include them.

These Service retention rules apply once the Service opens to you, as set out above. Frozen weekly summaries and recipient paging state are separate from the daily buckets. Paging identifiers are cleared when traversal completes or is expired, and during user purge; account purge removes run records. Frozen summaries use the same activity-week expiry cutoff as daily buckets; bounded maintenance removes expired records. A completed recipient traversal records queueing progress, not successful delivery to every recipient. Digest email summaries and queued email payloads are separate copies: bounded outbox maintenance minimizes payloads more than 30 days after delivery or abandonment, and email-provider copies follow the retention below.

Cookies and similar technologies

Our Cookie Policy lists everything this website stores or loads. In short:

  • Strictly necessary. One first-party cookie, scrutyn_consent, remembers your choice about advertising tags for about six months. Once the dashboard opens, a session cookie keeps you signed in to it, and Paddle's checkout uses its own necessary cookies to process payments.
  • Analytics without cookies. This website runs no analytics today. When the Service opens, we will run our own instance of Umami, an open-source analytics tool, on our own servers. It sets no cookies and stores nothing on your device. Before an event reaches it, we strip query strings, identifiers, package names and anything that looks like an access token. If your browser sends Global Privacy Control or Do Not Track, we send no analytics at all.
  • Ad measurement, only with your consent. If you choose "Accept all", or turn advertising on under "Customize", we load the tags of the ad platforms we advertise on (for example Reddit or Google Ads) on our marketing pages. They set their own cookies. They never load on the legal pages or the beta access pages. Once the Service sells plans, we may also report a purchase to them from our servers, with the click ID and a hashed email address. If you choose "Reject non-essential", or if your browser sends Global Privacy Control or Do Not Track, none of this happens. You can change your choice at any time with the "Cookie settings" link at the bottom of every page.

Who we share data with

  • Service providers that run parts of Scrutyn for us, under contracts that require them to protect the data. Today these are:

    • RareCloud: hosting, in the European Union;
    • Cloudflare, Inc.: DNS, and the proxy that protects and delivers this website;
    • Postmark (AC PM, LLC; United States): the emails about your beta request and, if you opt in, the product-updates confirmation and the updates themselves.

    More providers join when the Service opens; they are listed on our subprocessors page.

  • Paddle, our reseller and Merchant of Record once plans are on sale, which processes your purchase as an independent controller under its own privacy notice.

  • Ad platforms, only with your consent, as described above. They act as independent controllers.

  • Your team. If you are on a Team account, its owners and admins can see the team's devices, ledger and policies.

  • Authorities, when the law requires it, and our professional advisers under confidentiality.

  • A buyer or successor, if we sell or reorganise the business, under this policy.

We do not sell personal data.

International transfers

We host Scrutyn in the European Union. Postmark (AC PM, LLC) is based in the United States, and Cloudflare is a United States company with a global network, so data that passes through them can be processed outside the European Economic Area. For these transfers we rely on the safeguards these providers state: each says it is certified under the EU-US Data Privacy Framework, and each includes the European Commission's Standard Contractual Clauses in its data processing agreement. Our own legal review of these transfers is still pending, and we will update this section if it changes anything. You can ask us about it at catalin@scrutyn.com.

How long we keep data

Data Kept for
Beta access requests 12 months after your last activity (your last request, or our last contact with you about it), then deleted
Requests marked as suspected spam 30 days
Records of the emails we send about a request (delivery status, provider message ID) as long as the request they belong to
Hashed IP and email addresses used as rate-limit keys 48 hours
A product-updates request you have not confirmed 30 days, then deleted
Your product-updates consent record, once confirmed until you unsubscribe or withdraw consent; the record is deleted 30 days after you unsubscribe
Your address on our suppression list (after you unsubscribe, or if our emails to it bounce) kept with no end date, so that we can honour your choice and never email you product updates by mistake
Our administrators' audit trail (sign-ins, exports) 12 months
Records of the sign-in emails we send our administrators 30 days
Our administrators' sign-in links and sessions deleted a day after they expire, are used or end
Copies of our emails at Postmark according to the message retention set for our Postmark account. Postmark's standard retention keeps the content and metadata of each email for 45 days; it keeps bounces, spam complaints and unsubscribed addresses without an end date
Account, devices, policies while your account exists, then deleted within 30 days
Install ledger 7 days (Free), 1 year (Pro and Team)
Weekly digest count buckets expire at the end of the activity's UTC week plus 14 days (at most 21 days from activity); account purge also removes them
Digest preference while your user exists; user purge also removes it when the user row is retained in anonymized form
Frozen digest run summaries and paging state summaries expire within the same activity-week horizon as count buckets, with bounded cleanup; paging identifiers are cleared at traversal completion or expiry, or user purge; account purge removes runs
Notification outbox payloads, including digest summaries eligible for bounded minimization more than 30 days after delivery or abandonment; delivery identities remain for deduplication, and provider-held email copies follow their own retention
Technical logs 30 days
Backups Database backups are not configured yet. Before we turn them on, we will update this notice with how long they are kept.
Billing records as long as tax and accounting law requires
Support messages up to 2 years after the conversation ends
Website analytics events, once analytics runs 12 months
Your cookie choice about six months, then we ask again

Security

We store device tokens only as SHA-256 hashes, encrypt data in transit, run the scanners in isolated environments without network access, restrict and log administrative access, and remove tokens from our logs. Our logs of the beta access form record no email address, name or IP address. No system is perfectly secure. If a breach affects your personal data, we will tell you as the law requires.

Your rights

Under the GDPR you can ask us to:

  • give you access to your data;
  • correct it;
  • delete it;
  • restrict our processing, or object to it (you can always object to direct marketing);
  • give you your data in a portable format.

You can also withdraw your consent at any time; this does not affect processing that happened before. Email catalin@scrutyn.com, and we will answer within one month. Once accounts are open, you can delete your account and export your ledger yourself in the dashboard. You also have the right to complain to a data protection authority, in particular the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), 28-30 G-ral Gheorghe Magheru Bld., District 1, 010336 Bucharest, Romania, www.dataprotection.ro or the authority where you live or work.

US state privacy notice

This section applies if you live in a US state with a consumer privacy law, including California (the CCPA, as amended by the CPRA).

  • Categories we collect, and have collected in the last 12 months:

    • identifiers (email address, name, account and device IDs, IP address);
    • professional information you choose to give (your company);
    • commercial information (plan and purchase history);
    • internet or other electronic network activity (install ledger, technical logs, website analytics);
    • approximate location at country level, derived from the IP address.

    The sources, purposes and retention periods are described above. We do not use your data to build profiles or draw inferences about you.

  • Sale and sharing. We do not sell personal information. Only with your consent, ad platforms receive ad click IDs and, once plans are on sale, a hashed email address to measure our ads. Some state laws call this "sharing" for cross-context behavioral advertising. You can opt out at any time with the "Cookie settings" link, and we treat a Global Privacy Control signal as a valid opt-out.

  • Sensitive personal information. We do not collect it, and we do not use personal information to infer characteristics about you.

  • Your rights. You can ask to know and access your personal information, to correct it and to delete it. You can opt out of its sale or sharing. We will not discriminate against you for using these rights. Send requests to catalin@scrutyn.com. We verify a request by confirming that you control the email address it is about. An authorized agent can act for you with your signed permission.

  • We do not knowingly sell or share the personal information of consumers under 16.

Children

Scrutyn is for developers and is not directed at children. We do not knowingly collect data from anyone under 16. If you believe we have, contact us and we will delete it.

Changes

We post changes here and update the date at the top. For material changes we also tell the people affected by email, or in the dashboard once it is open, before the changes take effect.

Contact

Cloud Manager SRL, Str. S3, No. 16, Năvodari, Constanța County, Romania. Privacy questions and requests: catalin@scrutyn.com.