Privacy Policy

All Still Good, operated by Eastbase Studio (“All Still Good”, “we”, “us”), provides continuous health and security monitoring for web applications. This policy describes how we handle personal data when you use the service.

• Account data — your email address and authentication details. If you sign in with GitHub or Google, we receive basic profile information from that provider.
• Project data — the URL of an app you've verified you own, optional scan settings, and (optionally) a Supabase anon key or a connected GitHub repository you choose to add.
• Ownership-verification records — the method you used (DNS TXT record, meta tag, or well-known file), the verification token, the current status, and the timestamps of the attempt and the successful check. We keep these because they are the proof that monitoring was authorized for that domain; if anyone ever asks why we scanned an app, this is the record that answers it.
• Scan results — the findings, health scores, and history produced when we monitor your verified app (see Section 4 for what we deliberately do not keep).
• Billing data — handled by our payment provider (Lemon Squeezy). We receive your subscription status and plan, not your full card details.
• Usage & diagnostics — product-analytics events and error reports that help us understand activation and fix bugs (see Section 6).
• Communications — anything you send us by email or support request.

• To run the monitoring you ask for and deliver findings, alerts, and fix briefs.
• To verify ownership of a target before any scan runs.
• To operate billing, send service emails (such as alerts), and provide support.
• To understand activation and improve the product, and to keep the service secure and reliable.

We do not sell your personal data, and we do not use the contents of your app or your scan results to advertise to you.

The way All Still Good handles sensitive data is a core design decision, not an afterthought:

• Secrets are stored only as redacted fingerprints — never the raw value. If a scan finds a key in your frontend bundle, we keep the pattern name ("Stripe live secret key"), a masked preview of the first and last few characters, the file it was in, and a hash used to recognise the same finding on later scans. The full secret is never written to our database.
• Personal data exposed by your app is counted, not retained. If a table turns out to be readable without logging in, we record the table name and the approximate row count so you know the size of the problem — we do not copy your users' records into All Still Good.
• We never accept or store a Supabase service_role key. Keys are checked at the validation layer before they can be saved, and a service_role key is rejected with an error. The anon key you do provide is encrypted at rest.
• All probes are read-only and non-destructive — we send ordinary GET requests, follow what your app returns, and never write to, change, delete from, exploit, or stress-test your application.

These are enforced in code, not just policy. The trade-off is deliberate: it means a finding sometimes tells you less than a tool that kept everything would, and we think that’s the right way round for a service you point at your own live app.

To write plain-English findings and translate a synthetic-journey description into safe observational steps, we send redacted finding metadata (such as the issue type and the affected path) or the journey description you provide through Vercel AI Gateway to OpenAI’s GPT-5.6 models. We do not send raw secrets discovered by scans or retained user records for this purpose; do not put credentials or personal data in a journey description. If AI access is not configured, findings still work without AI explanations.

On your first visit we ask before loading anything non-essential. You can accept analytics, reject non-essential, or open preferences and decide per category. Product analytics does not load until you accept it — if you reject or simply ignore the banner, PostHog is never initialised and sets no cookies.

• Essential — keeping you signed in, security, and billing. Required for the service to work, so these are always on.
• Product analytics (needs your consent) — PostHog helps us understand how people activate (sign up → verify → first scan) so we can improve the flow. Off unless you accept.
• Traffic analytics — Vercel Analytics counts page views and referrers. It is cookieless, stores nothing on your device, and does not track you across other sites.
• Error monitoring — Sentry captures diagnostic information when something breaks so we can fix it. We keep this on because we need it to operate the service securely and reliably.

You can change your cookie preferences at any time, and your browser settings give you a further layer of control. If you withdraw consent, we stop analytics capture and clear the identifiers PostHog stored in your browser.

We rely on the following providers to operate All Still Good. Each processes only the data needed for its function:

• Neon — database hosting for your account, projects, and findings.
• Lemon Squeezy — payments and subscription billing (Merchant of Record).
• Vercel — application hosting, AI Gateway routing for AI-generated content, and cookieless traffic analytics.
• OpenAI (GPT-5.6) — AI-generated explanations, fix briefs, scan summaries, and journey steps.
• Resend — transactional and alert emails.
• PostHog — product analytics.
• Sentry — error monitoring.
• Inngest — background job scheduling for scans.
• OSV.dev — open-source vulnerability data for dependency checks.
• GitHub and Google — optional OAuth sign-in. If you additionally connect a GitHub repository, we use your GitHub authorization to read that repository's package manifest for dependency checks (read-only — we never write to your repository). Neither is used for ownership verification.

This list may change as the product evolves; we will keep it current.

Both are optional, and monitoring works without either.

• Ownership verification never uses GitHub. You prove you control a domain by publishing a token we give you — as a DNS TXT record, a meta tag, or a file under /.well-known/ — and we record the method, status, and timestamps of that check.
• GitHub repository access is a separate, opt-in feature. If you connect a repository, we read its package manifest to check your dependencies against public vulnerability data (OSV.dev). We do not clone your repository, read your source code, write, commit, or open pull requests. Disconnect the repository and the access stops.
• Supabase is opt-in too. You paste your project URL and your anon (public) key — the key your app already ships to every browser — and we use it only to check whether tables are readable without logging in. It is encrypted at rest, and a service_role key is rejected before it can be stored.

We keep account and scan data for as long as your account is active — the watch-over-time history is the product, so a baseline from six months ago is still doing work.

Self-serve deletion isn’t built yet. Email privacy@allstillgood.com to have a project or your whole account deleted. What happens then:

• Active systems — we aim to delete the data from our live database within 30 days of confirming your request, and usually much sooner. A connected Supabase anon key is destroyed at that point too.
• Backups and operational logs — deleted data can survive for up to about 90 days in encrypted database backups and in server/error logs before those rotate out. We don't restore a backup to bring deleted data back into service; it simply ages out.
• Legal, billing, and security exceptions — we keep what we're required to keep. Invoices and payment records are retained by our Merchant of Record, Lemon Squeezy, for the period tax and accounting law requires. We also retain a minimal record of ownership verifications and any abuse or security investigation for as long as needed to defend a legal claim or show that monitoring was authorized.

If you cancel a paid plan but keep your account, nothing is deleted — you return to the free tier and your history stays put until you ask us to remove it.

Depending on where you live, you may have rights to access, correct, export, or delete your personal data, and to object to or restrict certain processing. You can change your email and password in your account settings; for access, export, or deletion requests, contact us and we will respond as required by applicable law.

We use industry-standard measures to protect your data, including encryption in transit, encryption of sensitive stored values, ownership verification before scanning, and the minimization described in Section 4. No system is perfectly secure, but reducing what we store is our first line of defense.

Our providers may process data in countries other than yours; where required, we rely on appropriate safeguards for those transfers. All Still Good is not directed to children, and we do not knowingly collect data from anyone under 18.

We may update this policy as the product changes; material updates will be reflected in the “last updated” date above. For privacy questions or requests, email privacy@allstillgood.com or see our Terms of Service.