Privacy
AppPulse (https://getapppulse.com) stores the minimum we need to run scans, accounts, and billing.
What we collect
- The URL you ask us to scan, the findings, and the time of the scan.
- A hash of the network address, used to rate-limit the free scan. We do not store the raw address in the scan record.
- Account email, name, and a password hash if you create a password. Magic-link tokens expire and are single use.
- An optional email on the free scan, if you type one.
- Stripe customer and subscription ids. Card numbers stay with Stripe.
- Which domain-verification method succeeded. We do not keep a copy of your whole site.
Evidence is shortened
If a secret shows up in a public file, the report stores a shortened version, not the full key. Still rotate that key. Treat the report as sensitive and do not forward it casually.
Email list
New accounts, and free scans where you chose to leave an email, are sent to our ActiveCampaign list. If ActiveCampaign is unavailable, the account or the scan still succeeds and we log the failure. You can unsubscribe from marketing mail using the link in those messages. Security alerts and the Monday report are part of the paid service, not the marketing list.
Who we share with
Hosting (Vercel), the database (Postgres, typically Neon), email delivery (Resend or the provider in EMAIL_FROM), payments (Stripe), and the marketing list (ActiveCampaign) process data on our behalf. We do not sell scan contents.
How long we keep it
Account data stays until you delete the account or ask us to. Deleting an app deletes its scans and checks. Free-scan reports are kept so we can show you the result and enforce rate limits. Email us at privacy@getapppulse.com to ask for a deletion.
Sites you do not own
Scheduled monitoring requires a verification step so we are not watching someone else’s production app on your behalf. The free scan is still only for URLs you are allowed to test. See the terms.