VibRadar scans the public surface of websites and sells one-time reports. This page describes exactly what we collect, why we collect it, how long we keep it, and who else processes it. We have tried to describe what the software actually does rather than what is convenient to say.
If you submit a domain through the form on our home page, we store the domain and URL you submitted, the results of the scan, the time of the scan, and the IP address the request came from. The IP address lets us see abuse of the free scanner and separate real visitors from automated traffic. Scans are read-only: we never log in to a site, change anything, or run exploits, and we only look at pages and files that anyone on the internet can already reach.
Report pages live at a unique link. Each time one is opened we record the time, the IP address, the browser user agent, the referring page if the browser sends one, and the country your request was routed from. We also record a small number of events on the page itself: that the page was rendered by a real browser, that the paid section came into view, and that the unlock button was clicked.
The reason is specific. Mail security scanners and link-preview services open report links automatically, before any person sees them, and they look identical to a human visit in a plain server log. Without this data we cannot tell whether a report was read by someone or merely fetched by a machine, and we would draw false conclusions about our own product.
IP addresses collected on report pages are deleted after 30 days. A scheduled job clears them automatically. The remaining fields stay, because the analysis works without the address.
If you enter an email address to have a report sent to you, we store it with that report and use it to send you the report and, if needed, to reply about it.
We also contact site owners directly when an automated scan finds something exposed on their site. In that case the address came from the public contact details published on the site itself. Every such message identifies VibRadar, states what was found, and can be stopped by replying and asking us to stop. We do not sell, rent, or share these addresses.
Payments are processed by Polar as Merchant of Record. Card details are entered on their checkout and never reach our servers — we never see or store them. We store the order identifier, the amount, the status of the payment, and which report it unlocked.
We use Google Analytics 4 to measure traffic, and Microsoft Clarity, which records anonymised session replays: mouse movement, scrolling, and clicks on the page. Clarity is how we learn whether people reach the part of a report they are meant to read. Both set cookies in your browser and both receive your IP address as part of a normal web request. Neither is used to build advertising profiles by us.
You can block both with any standard content blocker, or by using your browser's private mode. Report pages work fully with analytics blocked.
Vercel (hosting), Supabase (database), Cloudflare (DNS), Polar (payments, Merchant of Record), Resend (outgoing email), Google (analytics), Microsoft (session recording). Each processes data only to provide its service to us.
IP addresses recorded on report pages: 30 days. Scan results and reports: until you ask us to delete them, or until the report is no longer useful to keep. Payment records: as long as required for accounting and tax. Email addresses: until you ask us to remove yours.
You can ask us what we hold about you, ask for it to be corrected, ask for it to be deleted, or ask us to stop contacting you. Write to us and we will do it — there is no form to fill in and no account to close. Deleting a report also deletes the visit records attached to it.
VibRadar is a tool for people who run websites. It is not directed at children and we do not knowingly collect data from them.
If we change what we collect, we will change this page and update the date at the top.
Reply to any email from us, or use the contact form.