Privacy
Last updated November 8, 2026
ChecksOut is made by Conatus LLC. We keep as little as we can, and we never sell or share what we keep for anyone else's marketing.
The short version
- We keep as little as we can: your email, the sites you claim, and short-lived logs for limits.
- The free check saves nothing it finds.
- Reviews read code only to run the review, then delete it. Only the findings are kept.
- We never sell your data or use it for advertising.
This is a summary. The full text below is what counts.
What we collect
- Your email address, if you sign in, to send your sign-in codes and know which account is yours.
- Sites you claim: the site's name, the verification code we gave you, and when you proved it was yours.
- A short log of free checks: a one-way hash of your IP address (never the address itself), your account if you're signed in, the site's name and the time. It's only for the limits on how often checks run, and it's deleted after two days.
- Feedback and problem reports you send: your message, your email if you give it, your account if you're signed in, and a one-way hash of your IP for spam limits. If you include technical details, also the page you were on and the details your browser sends about itself (its user-agent string).
- Error reports with personal details removed, kept for 30 days, plus a one-way hash of your IP kept for a day to limit how many reports one sender can send. And anonymous page views (Vercel Analytics, which uses no cookies to follow you across sites).
Cookies and what's saved in your browser
Only what sign-in needs. When you sign in, we set cookies that keep you signed in: one with your session, one that renews it, and one that just says you're signed in. They're removed when you sign out. If you use “Continue with Google”, a short-lived cookie carries the sign-in through Google and back. Your light or dark mode choice is saved in your browser, not sent to us. No advertising or tracking cookies.
What the free check keeps
Nothing it finds. A check reads what a site sends every visitor, shows you the results and forgets them. If a check finds a private key in a site's public code, we never store it and show only its first few characters, and only to the site's proven owner.
When ChecksOut checks a site, its requests are labeled ChecksOutBot so the site's owner can see them in their logs.
Signing in
You sign in with a 6-digit code we email you. To limit how often codes can be requested, we pass your IP address to Supabase, which runs sign-in and keeps it in its sign-in logs. If we add “Continue with Google”, we'll get your name, email address and profile picture from Google, and use only the email.
Full reviews
Full reviews aren't open yet. They'll need read-only access to the code you choose and test accounts for your app, and we'll update this page to say exactly what we keep and for how long before the first one runs. The plan: code is deleted when the review ends, test-account passwords are stored encrypted and deleted after the review, and only findings are kept.
Payments
ChecksOut doesn't take payments yet. When it does, Stripe will handle them and we'll never see your card details.
Who handles your data for us
- Supabase stores the database and runs sign-in.
- Vercel hosts the site and counts anonymous page views.
- Resend sends our emails, like sign-in codes.
Deleting your data
To delete your account and the sites you've claimed, email us from the address you sign in with. Free-check logs delete themselves after two days.
Contact
Email hello@conatusllc.com.