Privacy Policy

What we collect

• Account info: your email address, and if you sign in with Google, the basic profile info Google shares.
• Scan data: the repository URLs, server URLs, or config you submit for scanning, and the findings we generate from them.
• Abuse-prevention signals: a browser fingerprint (via the open-source FingerprintJS library) when you approve a device login, a hashed machine identifier from the CLI (and, while it was offered, from the now-retired Claude Code hook), and your IP address; used only to detect unusual multi-account signup patterns, never sold or used for advertising.
• Billing info: handled directly by Razorpay; we store your subscription status, not your card details.

Why we collect it

To run the service (scanning, showing you results, metering usage against your plan), to prevent abuse of the free tier, and to bill paid plans. We don't use your data for anything beyond operating Aevrin.

What we don't do

We don't sell your data. We don't use scan targets or findings for anything other than showing them back to you. We don't share machine/fingerprint signals outside of Aevrin's own abuse-prevention checks.

Source handling

Repository contents are cloned into temporary scan-worker storage and are not kept as part of scan history. Pasted configuration is processed by the scan job; durable history stores a fingerprinted label rather than the submitted configuration text. Findings, target identifiers, stages, and report data are retained in your account.

Automated analysis

Whether a vulnerability exists is always decided by the deterministic security tools identified in the product methodology, never by a language model. If you add your own AI provider key and ask for an explanation, a finding's title, description, and category (not your source code or repository contents) are sent to that provider to explain a result those tools already produced. Without a key, nothing is sent.

Aevrin MCP capabilities

When your agent runs a capability through Aevrin MCP, the input you give that capability (for example a search query or the address of a page to read) is sent to the trusted providers it needs in order to answer. Nothing else about your account travels with it: a capability never receives your API key, your sign-in session, your cookies, or your scan history. Every capability is reviewed and approved by an Aevrin administrator before it can run, and while it runs it can only reach the specific hosts named in its approved allow-list.

A capability can also be delivered as instructions instead of being run by us. In that case we send your agent the guidance an Aevrin administrator wrote and nothing you give it reaches us or any provider: your agent carries the work out on your own machine, with your own privileges, and we see only that the capability was retrieved. Retrieving a capability is recorded for metering against your plan; searching is free and is not counted.

Retention

Plan screens show the configured history window. You may delete an individual scan or clear your scan history at any time. Automated retention pruning is not currently presented as a guarantee.

Your data

You can revoke API keys and delete individual scans or all scan history from your account. Full account deletion is not currently self-service; this page will be updated with the operator's request channel before that flow is offered.