Privacy Policy

This Privacy Policy describes how Zenofex LLC ("we", "us", or "our"), operating Misconfigured.app (the "Service"), collects, uses, and protects your personal information when you use our website and services. By using the Service, you agree to the collection and use of information in accordance with this policy.

Account Information

We offer two sign-in methods. When you sign in using Google OAuth, we receive and store your name, email address, and profile picture as provided by Google. We do not receive or store your Google password. When you sign in via email, we collect only the email address you provide in order to send you a one-time sign-in link.

Usage Data

We collect information about how you interact with the Service, including search counts, result counts, findings viewed, and timestamps of activity. Raw search text is not retained in analytics. Saved searches retain the terms you explicitly save. This data is used to enforce usage limits, improve the Service, and prevent abuse.

Analytics Data

Browser Google Analytics collection is currently paused while we review its automatic collection settings. We do not load the Google Analytics tag or send new browser analytics events. Previously collected data may remain with Google under the existing property retention settings.

We measure completed account actions and confirmed billing events on our servers to understand adoption and retention. These records contain an account identifier, an action type and time, and, for payments, the amount and currency. They do not include search text, asset locations, credential values or payment card details. Account-linked measurement records are deleted when the account is deleted.

Payment Information

If you purchase a subscription, payment processing is handled entirely by Stripe. We do not receive or store your full credit card number. We retain only the Stripe customer ID and subscription ID necessary to manage your account.

Log Data

Our servers use your IP address for rate limiting and abuse prevention. IP addresses are held in transient memory and are not persisted to a database. Standard web server logs maintained by our reverse proxy may include IP addresses, request paths, and timestamps.

Moderation and Support Data

If you submit a takedown report or support ticket, we collect the details you provide, such as report reason, evidence links, ticket/reply content, account identifiers, and timestamps. We also store moderation outcomes and audit records related to those requests.

We use the information we collect to:

• Provide, maintain, and improve the Service
• Authenticate your identity and manage your account
• Enforce usage limits and subscription tiers
• Process payments and manage subscriptions
• Detect, prevent, and address abuse, fraud, and security issues
• Review, process, and enforce takedown and moderation requests
• Communicate with you about your account or the Service
• Comply with legal obligations

We do not sell, trade, or rent your personal information to third parties. We may share your information only in the following circumstances:

• Service providers: We share data with third-party services that help us operate the Service, including Stripe (payment processing), Google (authentication and Google Analytics), Resend (email delivery for authentication emails), and Cloudflare (edge delivery). These providers are bound by their own privacy policies.
• Legal requirements: We may disclose your information if required to do so by law, or in response to valid requests by public authorities (e.g., a court or government agency).
• Protection of rights: We may disclose information where we believe it is necessary to investigate, prevent, or take action regarding potential violations of our Terms of Service, suspected fraud, or situations involving potential threats to safety.

We retain your account information for as long as your account is active or as needed to provide the Service. If you wish to delete your account, please contact us and we will remove your personal data within a reasonable timeframe, except where we are required to retain it for legal or legitimate business purposes.

Search activity events are retained for up to 180 days. Daily search-limit fingerprints are keyed hashes and are removed after their short enforcement window. Individual finding view records are automatically deleted after 12 months. Aggregate usage counters (total findings viewed, daily search counts) are retained for the lifetime of your account to enforce usage limits.

Moderation, takedown, and support records may be retained for legal compliance, abuse prevention, dispute resolution, and audit purposes for as long as reasonably necessary.

We implement layered technical and organizational measures to protect your data:

• Encryption in transit: All connections to the Service are served over TLS 1.2+ (HTTPS). HTTP requests are redirected to HTTPS at the edge.
• Storage controls: Contact us for verified details about the current hosting configuration and storage protections.
• Authentication: Sign-in is handled via Google OAuth or single-use email links. Sessions expire after 30 days and use HTTP-only,Secure, and SameSite=Lax cookies.
• Access controls: Production infrastructure access is limited to the operator and is gated by SSH key authentication.
• Network isolation: The database is not exposed to the public internet. All access is via the application running in a private network.

No method of transmission or storage is 100% secure. While we use commercially reasonable means to protect your data, we cannot guarantee its absolute security.

For Enterprise customers and prospects evaluating the Service in a procurement process, the following information is available on request to our contact form (select Sales / pricing):

• Data Processing Agreement (DPA): Contact us to discuss your processing requirements and the documentation available before subscribing.
• Sub-processor list: The Service relies on a small set of sub-processors: Stripe (billing), Google (OAuth sign-in and Google Analytics), Resend (transactional email), and Cloudflare (edge delivery). A current list with locations and purpose-of-processing can be discussed during your review.
• Breach notification: In the event of a confirmed personal-data breach affecting your account, we will notify the account's billing email within 72 hours of confirmation, with a follow-up incident summary as investigation progresses.
• Data residency: Contact us to confirm the current application hosting location and your residency requirements. Edge delivery is global via Cloudflare.
• Account deletion: Account and associated personal data are deleted within 30 days of an Enterprise customer request, excluding any records we are legally required to retain (e.g. billing records).

An essential session cookie keeps you signed in. Browser analytics collection is currently paused, so the Service does not set new Google Analytics cookies. Previously stored analytics cookies can be removed through your browser settings. A first-visit cookie retains the landing path, referring host and limited campaign labels for up to 90 days to attribute account signups. It does not record search terms. We do not use cookies for advertising or remarketing.

The Service may contain links to third-party websites or services that are not operated by us. We have no control over, and assume no responsibility for, the content, privacy policies, or practices of any third-party sites or services.

The Service is not intended for use by anyone under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected personal data from a child without parental consent, we will take steps to remove that information.

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate personal data
• Request deletion of your personal data
• Object to or restrict processing of your personal data
• Request a portable copy of your personal data

To exercise any of these rights, please contact us at the email address below. We will respond to your request within a reasonable timeframe.

We may update this Privacy Policy from time to time. Changes will be effective immediately upon posting the revised policy on the Service. The "Last updated" date at the top of this page will be revised accordingly. Your continued use of the Service after any changes constitutes acceptance of the updated policy.

If you have any questions about this Privacy Policy, please contact us at [email protected].