Privacy Policy

1. Overview & Privacy Commitment

At StealthMark, we engineer security infrastructure with privacy-by-design. This Privacy Policy details what information our v6.0 100-point passive perimeter scanner, Static PDF CDR Inspector, and Domain Fix Pack service collect, how it is processed, and what we never collect.

2. What the Scanner Inspects & What It Never Collects

• Publicly Observable Signals Only: HTTP response headers, status codes, TLS 1.2/1.3 certificate metadata, public DNS records (A, AAAA, CNAME, TXT, SPF, DMARC, CAA, DNSSEC), public robots.txt / security.txt / llms.txt manifests, and passively indexed open ports/CVEs from Shodan InternetDB.
• Redacted Secret Detection: When our scanner detects exposed API key patterns in public JavaScript bundles, the raw secret value is immediately masked and never stored in plaintext.
• Never Collected: Private customer PII, end-user session cookies from your visitors, private source code, or raw credit card numbers.

3. Information You Voluntarily Provide

• Work Email for Alerts & Teaser Unlock: When you enter a work email on /scan or /enterprise/contact, we use it solely to deliver your requested scan findings, passive CVE/port radar alerts, or Enterprise scope proposal. Every email includes an instant 1-click unsubscribe link.
• Payment Data: Handled directly by our Merchant of Record, Polar (polar.sh). StealthMark never receives or stores raw credit card numbers or CVVs.

4. Cookies & Local Storage

We do not use third-party advertising pixels. When you purchase a Domain Fix & Forensic Pack, your browser's local storage saves the cryptographic unlock token for that audited domain so you can access your WAF rules and White-Label PDF report without creating an account.

5. Infrastructure & Sub-Processors

• Google Cloud Platform (us-central1) & Cloudflare: Host the StealthMark web application, edge WAF, and 100-point scanner gateway.
• Supabase: Stores scan telemetry and alert subscriptions (US region, TLS encrypted).
• Polar (polar.sh): Processes one-time Fix Pack payments as Merchant of Record.

6. Your Data Rights

Under GDPR, CCPA, and applicable privacy laws, you have the right to access, correct, or request immediate deletion of your email address or scan records. Write to security@stealthmark.ioCopy or support@stealthmark.ioCopy and we will process your request within 48 hours.