Privacy

The short version: no accounts, no cookies, no analytics, and your code is never kept. What little the site does hold, it holds for an hour or a day, and this page says exactly what.

psychosecurity.io is run by Faresay Ltd, a company registered in England, 167-169 Great Portland Street, London W1W 5PF. We decide how the site handles data, so for UK data protection law we're the controller. Questions go to hello@robinofloxley.com.

Scanning your code

When you drop a folder on the home page, your browser reads the files and sends the text ones to our server over HTTPS. The server scans them in memory, sends the report back and discards them. Nothing is written to disk, and the request isn't logged. The command-line tool and the GitHub Action never send your code anywhere: they run on your machine or your CI runner.

Checking a live site

When you check a site, our server fetches its pages the way a search engine would, as described on the visibility page. The address you typed isn't logged. A visibility report is kept for 24 hours, keyed by a hash of the address, so a site checked twice in a day isn't crawled twice. That report is about a public website, and it includes the site's address. The security check of a live site keeps nothing.

The visibility check can also review the home page's copy with Claude, Anthropic's AI model. When it does, the public text of that home page (its title, description, headline, first 1,500 words and any price lines) is sent to Anthropic's API, and the review is kept for a week, keyed by a hash of that text, so an unchanged page isn't reviewed twice. Nothing about you goes with it: not your address, not your IP. Anthropic's handling of API data is covered by its commercial terms.

If you fill in the optional "ask the AIs" panel, the product name, category, country and competitors you type are put into the questions sent to Anthropic (Claude searches the web to answer them), and kept with that report for 24 hours. The product name also goes to Serper, a Google search service, which we use to look for it on Product Hunt, G2 and the other directories; Serper's handling is covered by its privacy policy. Don't type anything there you wouldn't put on your own website.

Rate limits

To stop the scanners being used to hammer other people's sites, each request is counted against your IP address. The counters hold the address for at most an hour, then expire. They live in memory or in our rate-limit store (Upstash, through Vercel), and are used for nothing else.

Shared reports and badges

A share link carries the whole report in the part of the address after #, which browsers never send to a server, so we can't read the reports you share. A badge's address carries its own small, signed summary; when someone views it, our server checks the signature, draws the image and keeps nothing. If your browser can't check a signature itself, the report page asks our server to, and the server keeps nothing then either.

What we don't do

• No accounts and no sign-up.
• No cookies and no local storage.
• No analytics, tracking pixels or advertising.
• Nothing sold or shared, because there's nothing collected to sell.

Our host

The site runs on Vercel, which handles the requests that reach it and keeps its own short-lived operational logs under Vercel's privacy policy.

Your rights

Under UK data protection law you can ask what we hold about you, and ask us to correct or delete it. In practice, the only personal data we ever hold is an IP address in a rate-limit counter for up to an hour, so by the time you write it will be gone, but write anyway: hello@robinofloxley.com. If you're unhappy with our answer you can complain to the Information Commissioner's Office.

If this changes, this page changes first. Last updated 28 October 2026 (Serper added).