Privacy Policy

This Privacy Policy explains how Zenofex LLC ("we", "us") collects, uses, and shares information in connection with apk-scanner.com (the "Service").

1. Information we collect

• Account information — your email address, and if you sign in with Google, your name and profile image.
• Authentication — a signed, HttpOnly session cookie to keep you signed in; single-use, hashed sign-in link tokens.
• Usage data — apps you scan, your watchlist, plan and subscription status, and product interactions.
• Analytics — privacy-friendly, cookieless aggregate usage analytics via Cloudflare Web Analytics (page views and performance). No cross-site tracking and no advertising cookies.
• Payment data — processed by our payment processor (Stripe). We store a customer identifier and subscription status; we do not store your card details.
• Scan inputs — if you upload an application, the binary is analyzed and then deleted. We never store raw secrets; we retain only redacted, non-reversible finding metadata.
• Report engagement — first-party, cookieless metrics for public report views, evidence previews, upgrade intent and signup handoffs. We use a daily salted visitor hash derived from technical request data, rather than an email address or a persistent cross-site identifier. Event records are retained for 30 days; report engagement respects Do Not Track requests.
• Technical data — IP address and server logs, used for security, abuse prevention, and reliability.

2. How we use information

• To operate, provide, and improve the Service;
• To authenticate you and manage your account and billing;
• To send transactional messages and the change alerts you opt into by watching apps;
• To detect, prevent, and address security, fraud, and abuse; and
• To comply with legal obligations.

3. Cookies

We use an essential, HttpOnly session cookie for authentication. Our network provider (Cloudflare) may set cookies necessary for security and performance. We do not use third-party advertising or cross-site tracking cookies.

4. How we share information

We share information with service providers who process it on our behalf: Stripe (payments), Resend (transactional email), Google (optional sign-in), and Cloudflare (delivery and security). We may disclose information to comply with law or to protect rights and safety, and in connection with a business transfer. We do not sell your personal information.

5. Data retention

We retain account data while your account is active. Uploaded binaries are deleted after analysis. Finding metadata and aggregate corpus data may be retained as part of the Service. You may request deletion of your account and associated personal data by contacting us; we delete account data within 30 days of a verified request or account closure, except where retention is required by law. Data about scanned apps: public scorecards include information about third-party apps and their developers (names, icons, metadata, and automated findings), processed on the basis of our legitimate interest in security research and public-interest reporting. Affected developers may request correction or removal — see our Terms.

6. Your rights

Depending on your location, you may have rights to access, correct, delete, or port your personal data, and to object to or restrict certain processing. EU/UK users: our legal bases are performance of a contract, our legitimate interests in operating and securing the Service, and consent where required. California users: we do not sell personal information. To exercise any right, contact us below.

7. Security

We protect data with encryption in transit, redaction and non-reversible fingerprinting of any detected secrets, scoped access controls, and a hardened application configuration. No method of transmission or storage is perfectly secure.

8. Children

The Service is not directed to children under 16, and we do not knowingly collect their personal information.

9. International users

We operate in the United States; by using the Service, you understand your information may be processed there.

10. Changes

We may update this Policy; material changes will be posted here with a new date.

11. Contact

Zenofex LLC — privacy@apk-scanner.com.