Privacy
Draft for legal review. The controller, contact address and governing law are placeholders until the founder sets them (founder decision #1).
Who we are
postquantum.report is run by [legal entity: to be set]. Contact: [privacy contact address: to be set].
What we collect
- Domains you scan, and what our scanner finds on their public HTTPS endpoints. Results pages are reachable by anyone with the link and are never indexed by search engines.
- Your email address and your answers, only if you ask for an answer pack. We use them to deliver the pack and, if you opt in later, the emails you chose.
- Anonymous visit statistics: the page, the referring site, campaign tags, your country and your device type (mobile, tablet or desktop). We count unique visitors with a code made from your IP address and browser that changes every day and can't be linked across days. We never store IP addresses or browser user agents.
We set no cookies except what the site strictly needs, use no browser storage for tracking, and load no third-party analytics or advertising scripts. If you arrived from an ad, we may tell that ad platform, server to server, that a scan or verification happened, using only the platform's click ID: never your email address.
Why
To deliver the service you asked for: scanning a domain, and building and emailing your answer pack.
How long we keep it
- Scans that no pack uses: 90 days. Scans a pack uses: as long as the pack exists.
- Your email address and packs: until you delete them, or 24 months without activity.
- Visit statistics and scan requests: 13 months. Ad click IDs: 90 days.
- Server logs: 30 days. Error reports: 90 days after the error was last seen.
Your choices
- Delete your data any time at /delete: we email you a link that removes your address, your packs and their buyer links.
- Domain owners can opt their domain out of scanning; see /scanner.
- Every email we send says why you got it. We send no marketing on the pack email stream.
Where it's stored
On servers run for us by Fly.io (application and database), with Cloudflare in front and Postmark sending email. [Hosting region and transfer terms: to be confirmed at deploy.]