Privacy Policy

1. Information We Collect

1.1. Provided by You

• Target Domain: The URL you submit for auditing. This is treated as public information.

1.2. Automatically Collected

• IP Address: Stored as a per-IP counter in our rate-limiting database to prevent abuse and denial-of-service. It is retained for no more than 24 hours (see Data Retention). Your IP is also sent to our bot-protection provider to verify the CAPTCHA.
• Usage Telemetry: Cookieless, aggregate metrics (such as page views and visitor counts) via a third-party analytics provider. No cookie and no cross-site identifier is stored on your device.
• Scan Results: The graded output of an audit (grade, score, and the scanned site's public configuration) is cached to power the embeddable badge and public statistics.

1.3. Data From Scanned Sites

When you scan a target, our engine reads that site's public HTTP responses, including its headers, any Set-Cookie headers (so we can check cookie security flags), and page content, in order to score them. Sensitive values (cookie values, authorization headers, and any secrets our exposure checks surface) are redacted before any scan result is cached or shared. We do not retain a scanned site's session cookie values.

2. Third-Party Services & Recipients

To run the scan and deliver the Service, data is transmitted to third-party providers in the following categories (all currently based in the United States):

• Cloud hosting & database providers: Host the application and store cached results, share links, and rate-limit counters.
• Analytics providers: Cookieless usage measurement. No cookie and no device identifier is stored.
• Bot-protection providers: CAPTCHA verification to distinguish humans from bots; this receives your IP address.
• Third-party DNS, security-list, and vulnerability-database services: To perform the checks, the domain you scan (and, for an outdated library, its package name and version) is sent to external services. Only these non-personal scan inputs are transmitted; no IP address or personal data.

A scan also causes our server to request the target site itself and the third-party resources that site references. This is inherent to how scanning works. We may add or change providers within these categories; a current list of providers is available on request at security@orygn.tech.

3. Cookies & Local Storage

WebShield sets no tracking cookies of its own. We use a minimal set of functional storage:

• Theme preference: Stored in your browser's local storage (not a cookie) to remember your dark/light mode choice.
• Analytics: Cookieless. Our analytics provider sets no cookie and stores no identifier on your device.
• Bot protection (CAPTCHA): The CAPTCHA widget runs in a frame served by our bot-protection provider and may set security cookies scoped to that provider's own domain to validate your browser. These are essential to the bot check and are not set by WebShield.

4. Data Retention

• Public domain grades: The letter grade and score for a scanned domain are retained to power the public badge and statistics, and may be displayed indefinitely. They contain no personal data.
• Rate-limit records (IP): Retained for up to 24 hours, then removed by an automated daily cleanup.
• Short-term scan cache: A scanned site's redacted result is cached for 60 seconds to prevent scan-flooding, then expires.
• Shared reports: If you create a share link, the redacted report is stored for 24 hours and then automatically deleted.

You may request deletion of cached data related to domains you own by contacting us.

5. Data Security & Breach Notification

We implement commercially reasonable technical and organizational measures to protect data from unauthorized access, loss, or misuse.

• Encryption in Transit: All data is transmitted via HTTPS (TLS 1.2+).
• Encryption at Rest: Database records are encrypted at rest by our database provider.
• Access Control: Writes to the database are restricted to server-side service credentials; administrative access is limited to authorized personnel.

Breach Notification: In the event of a data breach affecting personal data we hold, we will investigate promptly and notify affected users and any applicable regulators as required by law.

6. Your Privacy Rights

We do not sell, trade, or rent any user data to third parties. We are not a data broker. Even as a "free" tool, you are the user, not the product.

Depending on where you live, you may have the right to access, correct, delete, or port your personal data, and to object to or restrict its processing. California residents have the right to know, delete, and opt out of the sale or sharing of personal information; we do not sell or share personal information. We process IP addresses under our legitimate interest in preventing abuse and securing the Service.

To exercise any of these rights, or to request deletion of data, contact us at security@orygn.tech. We will respond within the timeframe required by applicable law.

7. Children's Privacy

The Service is not directed to children under 16 (or the minimum age required in your jurisdiction), and we do not knowingly collect personal data from them. If you believe a child has provided us personal data, contact us and we will delete it.

8. International Transfers

Orygn LLC is based in the United States and processes data there. If you access the Service from outside the United States, your information will be transferred to, stored, and processed in the US where our servers and central database are located. Where required, we rely on appropriate safeguards (such as Standard Contractual Clauses) for these transfers. By using the Service, you understand that your information will be processed in the US.

Contact Us

If you have questions about this Privacy Policy or our data practices, please contact:
security@orygn.tech