Privacy Policy
What we collect when you review rules with DetectionLint, why, and who else touches it.
Last updated: April 22, 202601Information We Collect
When you create an account, we collect your name, email address, and profile picture via OAuth (Google or GitHub). We also receive the detection rules you paste into the analyzer and the analysis results we generate for you. We do not collect payment card data directly — payments are processed by Polar (via our parent, Response Bridge).
02How We Use Your Information
- To create and manage your account
- To issue and manage your API key(s)
- To analyze the detection rules you submit and return quality scores
- To track analysis usage and enforce plan limits
- To send transactional emails: welcome on signup, payment receipts, subscription cancellations, API key rotation alerts, monthly quota warnings, and admin-initiated plan changes
- To send optional monthly usage recaps summarising your detection rule analyses. You can unsubscribe from these at any time using the link in the email or by contacting support@detectionlint.org
03Data We Do Not Collect
We do not sell your data. We do not use your data for advertising. We do not redistribute private detection rules you submit to the analyzer — public library submissions are opt-in only.
04Usage Data
We store aggregate analysis counts (per month) to enforce plan limits and provide usage statistics in your dashboard. These counters are stored in our database alongside minimal metadata (rule format, score, timestamp) and are linked to your account.
06Third-Party Services (Subprocessors)
We use the following third parties to operate the Service. Each is subject to their own privacy policy and, where applicable, a Data Processing Agreement.
- Google / GitHub OAuth — authentication (email, name, profile image)
- Polar — payment processing. We do not receive or store your card details; only customer and subscription IDs are kept on our side
- Resend — transactional and notification email delivery. Your email address, name, and the content of emails we send you are transmitted through Resend. Their DPA: resend.com/legal/dpa
- Cloudflare — DNS and edge proxy for detectionlint.org
- Render — application hosting
- Neon — managed PostgreSQL database (EU region)
07Data Retention
We retain your account data for as long as your account is active. When your account is deleted, your personal data (user record, API keys, submitted rules, analysis results, usage history) is permanently removed from our database immediately. Email metadata held by our email provider (Resend) is retained according to their retention policy.
08Email Communications
Transactional emails about your account (welcome, payment receipts, security notices, plan changes) are necessary for operating the Service and cannot be disabled without closing your account. Non-transactional emails (currently only the optional monthly usage recap) include an unsubscribe link in every message; you can also email support@detectionlint.org to opt out.
09Your Rights
You may request access to, correction of, or deletion of your personal data at any time by contacting privacy@detectionlint.org.
10Security
All data is transmitted over HTTPS. API keys are stored as truncated display values only — the full key is shown once at creation and is not recoverable.
11Contact
Privacy questions: privacy@detectionlint.org