What we keep, who processes it, how long it is held, and how to have it deleted.
Account: the email address and profile information your sign-in provides, and the sessions you sign in from. Targets: the domains you record an authorization for and the scope you chose. Collected evidence: the public records a scan observed - hostnames, addresses, HTTP responses, routes, JavaScript artifacts, and template matches - with the time each was collected. Operation: scan state, capacity counters, and error records used to run and support the service.
To run the scans you ask for against the targets you authorized, to show you the results and keep their history, to secure the account, to answer support and data requests, and to account for your membership. We do not use workspace records to build advertising profiles.
Clerk provides identity and sign-in. Cloudflare delivers the site and stores product records. Collection and evidence storage run on infrastructure we operate. These providers process data on our instructions for the purposes above. Any additional provider is named here before it is used.
Public recon observations and collection history are stored by domain and can be reused by other members who independently authorize the same domain and have Full Access. Your account identity, saved target list, authorization records, individual tool inputs and results, private evidence previews, and finding status changes are not shared with those members.
Account records and private evidence are retained to provide the service and handle support and data requests. Removing your access to a target does not erase its shared public collections for other authorized members. Contact us to request account or evidence deletion; we explain what can be removed and any applicable retention requirements. Records may remain in backups until those backups expire.
You can review what is stored in the workspace, export the records a view shows, correct the account email through sign-in, delete a target, or ask us to delete the account. Start through the contact page; we arrange a private conversation and explain the next step. Do not post account details publicly.
The service is for business use and is not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has an account, tell us and we will delete the account and its records.
Collection reads require a current account, Full Access, and authorization for the saved domain. Shared public history is available only through these checks; account data, private evidence previews, and scan controls remain restricted to their owner. Collection runs inside fixed request and socket budgets. If you find a problem, report it rather than testing it against another member's data.
Cloudflare processes ordinary connection data to deliver the site and defend it. Public pages can use Cloudflare Web Analytics when the visitor enables measurement; workspace records are excluded. See the cookie policy.
A material change to this page is stated here with a new effective date before it applies.
Contact us on X to arrange a private conversation. We explain the next step, including anything we are required to keep for accounting or legal reasons. Keep account details out of public posts.
Misconfig.ai - GK Data LLC, Minnesota, United States. Effective 26 September 2026. @misconfig_ai on X
