Your data stays yours.

Last updated October 2026. This policy covers the BountyForge SaaS product at bountyforge.xyz and the Enterprise console at app.bountyforge.xyz.

1 · Scope

BountyForge provides security testing — SaaS scans you authorize against targets in your scope, and an Enterprise console for organizations that verify domain ownership. This policy describes what we store to run those services, and what we never do with it.

2 · Data we collect

Account data — email address and sign-in records. SaaS uses passwordless magic-link sign-in; Enterprise requires a work email and optionally GitHub SSO.
Organization data (Enterprise) — organization name, members and roles, team assignments, and the domains you verify, including verification tokens.
Scan data — targets you submit, scan configuration and schedules, findings, evidence, and reports. Findings belong to you.
Test credentials (Enterprise) — test accounts, header values, and cloud-connection secrets you declare so scans can authenticate. They are encrypted at rest, write-only, and never returned by the API or shown in results.
Billing data — plan, scan quota usage, and purchase records. Card payments are processed by our payment provider; we never see or store full card numbers.
Operational logs — server and security logs (requests, errors, abuse signals) kept to run and defend the service.

3 · Cookies & local storage

Essential cookies only — session and security cookies that keep you signed in and protect against abuse. No advertising trackers, no third-party analytics beacons.
Local storage — theme preference, organization context, and your cookie-consent choice. This never leaves your device.
Declining the consent banner still lets you use the product; only the essential session and security mechanisms keep running.

4 · How we use it

Run the scans you launch, against the targets you authorize — and nothing else.
Operate accounts, enforce scan quotas, verify domain ownership, and prevent abuse.
Bill paid plans and issue license keys.
Respond to support requests and send service-critical notices (sign-in links, quota and license events).

We do not train models on your scan data, findings, or credentials.

We do not sell your data to anyone, and we do not share scan targets or findings with third parties.
Service providers that process data on our behalf — hosting infrastructure, email delivery, and payment processing — see only what they need to perform their function.
We disclose data only when required by law, and we will challenge overbroad requests where we can.

6 · Self-hosted installs

Self-hosted Enterprise runs entirely on your infrastructure: scan data, credentials, and findings never reach our servers. Online license check-ins transmit scan counts only — never target data. Air-gapped installs use an offline license file and transmit nothing.

7 · Retention

We keep account and scan data while your account is active and as needed to provide the service. Ask us to delete your account and we delete its data, except for the minimal records the law requires us to keep (for example, invoices). You can export your findings and reports at any time.

8 · Your rights

You can request access to, correction of, export of, or deletion of your personal data at any time by writing to [email protected]. We respond to every request.

9 · Security

Traffic is encrypted in transit (TLS, HSTS). Secrets are encrypted at rest.
Every Enterprise record is scoped to its organization; test credentials are write-only.
Scans run in isolated sandboxes against verified, authorized targets only.

10 · Children

BountyForge is a professional security product and is not directed at children under 16. We do not knowingly collect their data.

11 · Changes

If this policy changes materially, we update the date above and notify account holders by email before the change takes effect. Minor clarifications take effect when posted.

12 · Contact

Questions about privacy or your data? [email protected]