Privacy Policy

1. Introduction

Kryptheon helps developers find bugs and security holes in their web apps: it replays flows they record, reads their frontend code, and attacks a copy of their database's structure. This Privacy Policy describes the categories of information we may process, why we process it, and the choices available to users.

2. Information We Collect

The information we process depends on how you use Kryptheon and which features you enable. It may include information you provide directly, authentication information, technical usage information, and software diagnostic data.

3. Information You Provide

You may provide information when requesting a demonstration, contacting us, creating or managing an account, submitting feedback, or using product features. This may include your name, business contact information, organization, messages, and information you choose to submit.

4. Account and Authentication Information

If account features are enabled, we may process identifiers and authentication-related information needed to create and maintain your account, protect access, and support your session. Authentication credentials should be handled through the supported sign-in flow rather than submitted as diagnostic content.

Accounts on kryptheon.tech are optional. An account holds the name you give, your email address, and when the account was made. Your password is stored by our authentication provider as a one-way hash; we never see it. Kryptheon's command-line tools do not send your code, recordings, database structure or results to us, with or without an account - they stay on your machine. The one thing that does reach us is the nightly check's summary, and only if you switch the nightly check on: section 7 says exactly what it holds.

5. OAuth and Google Account Information

If you choose to connect a supported third-party service, including a Google service, Kryptheon may receive information that you authorize through that provider's OAuth consent flow. Kryptheon will request and use only the permissions needed for features you explicitly enable. The specific information available depends on the provider, the permissions displayed to you, and your choices during authorization. You can manage connected access through the applicable provider and any controls made available within Kryptheon.

6. Technical and Usage Information

When the service is used, technical information may be processed to operate, secure, and understand the service. Depending on the implementation and features in use, this may include browser or device information, network information, request metadata, service interactions, and error or performance information.

7. What the Nightly Check Sends

The nightly check is off until you switch it on: you add a project on your kryptheon.tech dashboard, which gives you a script, and you run that script in your own Supabase project. From then on it runs inside your database every night and sends one summary to Kryptheon after each night. That summary holds, for each problem found: the kind of problem (for example "can be read by anyone"), the name of the table, the name of the column when the problem is about one, and whether it was proven or only spotted. It also holds how many problems there were, how many things could not be tested, which version of the check ran, and whether the night finished. It never holds a row of your data, a value from any column, your connection string or a password. A project token, made for that project and stored by us only as a one-way hash, shows which project the summary belongs to.

We keep each night's summary under your account. On Starter your dashboard shows the counts; on Pro and Studio it also shows which table and what kind of problem. Removing a project on your dashboard deletes its summaries. To stop the check sending anything, remove the project and paste the uninstall script your dashboard gives you into your database. The emails about your nights are sent through Resend, and say only what the summary says.

If you write to us, include only what is needed to understand the problem. Never send passwords, connection strings, secrets or authentication tokens.

8. How We Use Information

We may use information to provide and maintain the service, authenticate users, process requested diagnostic workflows, improve reliability and usability, respond to support requests, protect the service, investigate abuse, communicate service-related information, and comply with applicable obligations.

9. How We Share Information

Information may be processed by service providers needed to operate Kryptheon, such as hosting, infrastructure, authentication, support, or other operational providers. We may also disclose information when reasonably necessary to comply with law, protect rights and safety, investigate misuse, or complete a business transaction subject to appropriate safeguards.

10. Service Providers

Accounts, and the nightly summaries, are handled by Supabase, our authentication and database provider; the website is hosted by Render; emails are sent through Resend; and payments are taken by Razorpay. Service providers may process information on our behalf to perform operational functions. Their access should be limited to what is reasonably necessary for those functions. The providers used may change as the service evolves.

11. Data Retention

Information may be retained for as long as reasonably necessary to provide the service, maintain security and operational records, resolve disputes, meet legal obligations, or as otherwise described within the product. Retention may vary by information type and feature. We do not promise immediate deletion where a deletion control has not been implemented.

12. Data Security

We use reasonable administrative and technical measures appropriate to the service's current stage to protect information. No service or transmission method can guarantee absolute security. Users are responsible for protecting their accounts, access methods, and the information they choose to submit.

13. User Choices and Rights

You may choose not to provide optional information or connect optional services. You may also revoke a connected service through that provider. Depending on your location, you may have legal rights relating to personal information. Requests can be sent to the contact below and may require reasonable identity verification.

14. Cookies and Local Storage

Kryptheon may use cookies, local storage, or similar browser mechanisms when needed for authentication, security, preferences, and core service operation. Available controls depend on your browser, but blocking essential storage may affect service functionality. This policy does not claim use of advertising cookies or a particular analytics system where that implementation has not been established.

15. Children's Privacy

Kryptheon is a software-development product and is not directed to children. If you believe a child has provided personal information through the service, contact us so the situation can be reviewed.

16. International Processing

Service providers and infrastructure may process information in countries other than where you live. Data-protection laws may differ across locations. Where required, we will take measures appropriate to the relevant processing and service operation.

17. Changes to This Privacy Policy

We may update this policy as Kryptheon and its practices evolve. The revised policy will be posted on this page with an updated effective date. Material changes may also be communicated through reasonable service channels.

18. Contact

Questions or requests concerning this Privacy Policy can be sent to company@kryptheon.tech.