privacy
what we collect,
what we don't, and who sees it.
if it's not on this page, we don't collect it.
version 1.10, effective 2026-10-09.
who is responsible
the controller.
PurpleOps Ltd, company no. 516961380, Sokolov 68, Herzliya, israel, is the controller of the personal data described on this page. contact: team@recon.sh. where the scan evidence contains personal data belonging to your users, you are the controller of that data and we process it on your behalf.
what we collect
the data, in full.
account: you log in with your email address. we email you a one-time sign-in link and store only a hash of its token, with your email address, the page to return to after you sign in, its expiry, your IP address and user-agent. signing in starts a session: we store only a hash of the session id, with its expiry, your IP address and user-agent. there are no passwords. your account record holds your email, when you signed up and last logged in, your marketing email choice, and the scans you own. credits and payments: we keep an append-only ledger of your credits: every pack purchase, scan charge, unlock, credit given back (to the pack it came from, or as a separate credit) and pack refund, with its time, its amount, and the scan or order it belongs to. for each pack purchase we keep the pack, its price, the Polar order id, and its refund status. we also record whether you ticked the spend-now box at pack checkout (its version and wording), and when you cancel a pack from your account page, the time you asked. for findings bought through our earlier per-finding checkout, the email you checked out with is recorded with that payment. billing is handled by Polar, our payment processor and merchant of record; we never see or store card numbers. reports and share links: each scan is tied to the account that started it, and its report opens only for that account. if you create a share link, we store only a hash of the link's token and when you created it. anyone with the link can read and download the report until you revoke it. revoking a link does not recall a copy someone already downloaded. domain verification: for each domain you verify, we record the domain and apex, the verification method (DNS TXT), the token issued and its expiry, the raw evidence observed (the DNS response, the resolver used, and a timestamp), your IP address and user-agent, and the outcome. we re-verify at scan-start; that creates a separate record. scan inputs: target domain, scope settings, and test credentials if you supply them for authenticated testing. warranty acceptance: before each scan we record the version and full verbatim text of each authorization statement you accepted (with a hash of each), your acceptance of the terms and the terms version, your request to start the scan (its verbatim text and a hash), your IP address, user-agent, time zone, the timestamp you submitted, and dwell time in milliseconds. unlock confirmations: before each unlock we record the version and verbatim text of the confirmation you ticked (with a hash), your account id and email, the scan, the findings and the credits each cost, the spend it authorizes, the terms version, your IP address, user-agent, time zone, the time and dwell time, and then the id of the confirmation email we sent you. retests: when you retest findings we record which findings, the result, the fresh request and response, and your authorization for the retest. retest results are kept and deleted with the report they belong to. attestation letters: when you issue one, we store the company name you type, the domain, scope, dates and the severity counts at that time. anyone with the letter's link can see these on its verify page. letters are kept until you revoke them, then for the audit retention period, and are revoked when your account closes. audit log: besides domain verification, warranty acceptance and unlock confirmation records, the audit log records when we delete stored test credentials and when a report expires. scan output: findings, severity, evidence packages (HTTP requests, responses, screenshots, reproduction steps), unlock decisions, and payment events.
what we do with it
why each piece exists.
your account email is how you log in. it receives sign-in links, the report-ready notification, a receipt when you buy a credit pack, a confirmation of each unlock, an email when you ask to close your account and when the closure is done, and, for paid reports, a reminder before the report expires. for a report paid through our earlier per-finding checkout, that reminder goes to the email you checked out with. we record your marketing email choice and send marketing email only if you opted in. billing details are used to sell you credit packs, refund unused credits, and handle refunds for findings bought through our earlier per-finding checkout. the credit ledger is the record of what you bought, spent and got back. hashed sign-in tokens, sessions and share-link tokens keep your account and your reports locked to you. domain verification evidence establishes legal proof of authorization before a scan runs. warranty acceptance is the legal record that you authorized the test. audit log entries (verification, warranty, credential deletion and report expiry) are the record that proves authorization, and shows what we deleted and when, if a dispute arises. we do not use your data to benchmark competitors or build products unrelated to your scan.
legal basis
why we're allowed to process your data.
if you are in the european union or the united kingdom, we rely on the following legal bases under the GDPR and UK GDPR. contract: to run your account and credit balance, verify your domain, run the scan you requested, and deliver findings. without this data we cannot provide the service. legal obligation and legitimate interest: to keep the append-only audit log that proves you authorized each scan, to prevent abuse of the service, and to secure our systems. our legitimate interest is operating a lawful security-testing service and defending against misuse; we weigh it against your rights. consent: where you choose authenticated testing, you consent to your test credentials passing through Anthropic, our AI provider, for that scan. you can decline by not using authenticated testing. withdrawing consent does not affect processing already carried out.
third parties
who else sees your data.
our AI provider, Anthropic (the company behind the Claude models), runs the scan. it sees scan inputs, scope settings, and test credentials if you supply them. we delete our stored copy of your credentials when the scan starts, when our scanner claims the job, or after 24 hours if the scan has not started by then, or when it is cancelled; the scanner deletes its own working copy when the scan ends. a pasted session is handled like a test password: encrypted while we hold it, delivered once to the scanner, deleted from our systems when the scan starts, never included in backups. a third party AI provider processes it while the scan runs. we do not currently have a contractual restriction on Anthropic's use of data sent through its standard api; if that matters to your organization, do not use authenticated testing until we confirm otherwise in writing here. a payment processor (Polar, which processes cards through Stripe) sees billing details, transaction amounts, and your email. an email provider sends sign-in links, report-ready notifications, pack receipts and other account emails to your account email. during a scan your app may send test email (sign up confirmations, resets) to addresses on webhook.site, a service operated by a third party. mail that arrives there is visible to that service. third-party public dns resolvers see the domain being verified. no personal data. infrastructure providers for hosting and databases store your scan data. test credentials are encrypted before storage; other scan data sits in our access-controlled database. we engage these providers under data processing agreements. our site sits behind Cloudflare, which provides DNS, TLS termination, and protection against attacks. because Cloudflare terminates TLS at its edge, it processes traffic to recon.sh in transit, including any test credentials you submit, but does not store your scan data. the login form also runs Cloudflare Turnstile, a check that tells people from bots: when you ask for a sign-in link, it sees your IP address and signals from your browser. Cloudflare also stores our database backups (R2, in the EU); they are encrypted before they reach Cloudflare, and the key is not held there. we engage Cloudflare under a data processing agreement. we use operational tools to alert our team about payments and scans. we do not sell or rent personal data.
data location
your data may leave your country.
PurpleOps Ltd is an israeli company; the european commission and the UK recognize israel as giving personal data adequate protection. our servers are in the united states, and our AI provider (Anthropic), payment processor, Cloudflare, operational tools, and hosting and storage providers may process your data in the united states and other countries outside the EU, the UK, or your home country. where we transfer personal data out of the EU or UK, we rely on the transfer mechanisms allowed by law - typically the european commission's standard contractual clauses and the UK addendum, alongside our providers' own safeguards - and on the israeli rules on transferring data abroad. email team@recon.sh if you want more detail on a specific provider.
cookies
cookies and local storage.
we keep the service lean. when you log in we set one session cookie (recon_session) that keeps you signed in for up to 7 days, or until you log out; it is http-only, so scripts on the page cannot read it. if you switch the site theme or turn motion off, a small cookie remembers that choice. the scan wizard stores your progress in your browser's session storage (target, scope, verification token) so you do not lose it between steps; it is cleared when the scan starts or the tab closes, and it never leaves your browser. we do not use advertising cookies, analytics trackers, or third-party pixels, and we do not profile you or follow you across other sites. any cookies we set are strictly necessary to run the site securely or remember a choice you made.
retention
how long we keep it.
test credentials: we delete our stored copy when the scan starts, when our scanner claims the job, or after 24 hours if the scan has not started by then, or when it is cancelled. the scanner deletes its own working copy when the scan ends. we do not log credentials in application logs. the report will remind you to rotate or revoke any credentials you supplied. the audit log (domain verification, warranty acceptance, unlock confirmation, credential deletion and report expiry records): kept for as long as your account exists and for 7 years after it closes, the period in which a claim about authorization could still be brought. these records are append-only and cannot be modified or deleted on request. they are a legal asset. if you ask us to delete your data, these audit rows remain; we will tell you this first. billing records: retained by Polar per its retention policy and applicable tax and financial record requirements. your account: kept while your account exists. you can close it from your account page or by emailing team@recon.sh. when you ask, we sign you out everywhere and revoke your share links. when the closure is done, we refund your unused paid credits, expire your reports, delete any stored test credentials, and replace the email address on the account with a placeholder that contains nothing from it. what we keep after closure: the audit log, the credit ledger and pack purchases, purchase records and the severity-count stubs of your reports, for 7 years after closing. the audit log and ledger rows keep your account id and the email recorded at the time, as the legal record. signing in again with the same email starts a new, empty account. hashed sign-in tokens and sessions stay in our database after they expire; they can no longer be used. credit ledger and pack purchases: append-only, and kept for as long as your account exists and for 7 years after it closes, like the audit log. they are the financial record of what you bought, spent and got back, and they cannot be modified or deleted on request, including when you close your account. scan reports and findings: reports auto-expire. retest results are kept and deleted with the report they belong to. a report with no paid unlock is deleted 30 days after the scan completes; a report with at least one paid unlock (with credits, or through our earlier per-finding checkout) that was not refunded or given back, 6 months after. on expiry we destroy the finding evidence (requests, responses, PoCs, reproduction steps, remediation) and the online report becomes a stub showing only the severity counts. apart from the encrypted backups described below, we keep no copy of the details; the self-contained HTML export you download is your copy, so grab it before the report expires. a share link to an expired report shows only that stub. paid customers get a reminder email 14 days before expiry. payment records, the credit ledger and the append-only audit log are retained as described above. you can still email team@recon.sh to have a specific scan deleted early; a copy already inside a backup stays there until that backup ages out. backups: every night we back up our database. each backup is encrypted with age before it leaves our server, and the key that decrypts it is kept offline, not on our servers. backups are stored in Cloudflare R2, in the EU. daily backups are kept for 30 days and deleted by day 35. the first backup of each month is kept for 7 years. backups are locked: no one, including us, can delete a backup before its retention period ends. a backup holds what our database held that night, including your account, the credit ledger, the audit log, and report findings and evidence, so data that has since expired, or that you asked us to delete, can remain inside a backup until that backup ages out. test credentials are never included in a backup.
breach notification
if something goes wrong, we tell you.
if we become aware of a security breach that affects your personal data, we will notify you and any supervisory authority required by law without undue delay - where the GDPR applies, within 72 hours of becoming aware, to the extent feasible. where israeli law requires it, we also notify israel's privacy protection authority. the notice will describe what happened, what data was involved, and the steps we are taking. this is about a breach of our systems. it is not about the vulnerabilities we find in your scan target - those are the findings we deliver to you.
your rights
what you can ask for.
subject to applicable law, you may request access to the personal data we hold about you, correction of inaccurate data, deletion of your scan data (subject to the audit log and backup exceptions above), or restriction of processing. email team@recon.sh. we respond within the time the law requires - generally within one month under the GDPR and within 45 days under the CCPA - and may ask you to verify your identity before acting on a request. note: audit log entries (domain verification, warranty acceptance, unlock confirmation, credential deletion and report expiry records) are exempt from deletion requests. this applies regardless of jurisdiction. if you are in israel: this page is also our notice under section 11 of the israeli protection of privacy law. you are under no legal duty to give us your data, but without your email we cannot open an account, and without the scan inputs we cannot run a scan. we use your data for the purposes on this page and share it only with the parties named in "third parties".
regional rights
extra rights, depending on where you live.
the rights above apply to everyone. some regions add more. EU and UK (GDPR): on top of access, correction, deletion, and restriction, you have the right to data portability, to object to processing based on legitimate interest, to withdraw consent, and to lodge a complaint with your data protection authority. in the UK that is the ICO; in the EU it is your national authority. California (CCPA/CPRA): you have the right to know what we collect and why, to access and delete it, to correct it, and to opt out of the sale or sharing of personal information. we do not sell or share your personal information, so there is nothing to opt out of, and we will not discriminate against you for exercising any right. to exercise any of these, email team@recon.sh. the audit log and backup exceptions above still apply.
children
the service is for adults.
the service is not intended for anyone under 18. we do not knowingly collect personal data from users under 18. if you believe we have, email team@recon.sh and we will delete it; a copy already inside a backup stays there until that backup ages out.
changes
when this policy changes.
when this policy changes, we update the version and date on this page and, for material changes, email your account address.
contact
privacy questions.
email team@recon.sh for privacy requests or questions about this policy. security concerns about recon.sh itself go to team@recon.sh.