Your data

What we collect and why

We keep your account and workspace details, permissions, consent choices, billing and usage records to provide Lockpick and protect access.

Website scans

Pulse and hosted Deep read public pages, scripts and domain records. We keep results and redacted evidence to show findings and track repairs. Quick checks expire after 7 days by default.

The archive reaches our servers. AI review, when configured, sends selected file text and paths to Anthropic after redaction. We erase raw upload chunks when processing finishes; a paused full review keeps them so it can continue. Completed or failed assessments expire after 30 days.

Automated redaction may miss sensitive values. Do not upload credentials or unrelated personal data. Dependency checks can send package names and versions to OSV.

Deep Local

Source files and reports stay on your machine. Lockpick receives the project, requested checks and scanner versions to authorize the scan and records that authorization. If you share results with an AI assistant, its provider receives what you share.

Dependencies and connected repositories

Monitor keeps package names and versions you send. A connected repository also supplies repository and commit details plus the selected manifest and lockfile for dependency analysis. Public repository and skill checks read the code you select; AI review can send redacted excerpts to Anthropic.

Ask Lockpick

Questions and recent messages go to Gemini and, when answer matching is enabled, TypeSafe. TypeSafe may receive site names and addresses to match an account question. Answer metadata is kept for 30 days; question text storage is off by default.

Cookies and optional analytics

Sign-in cookies are needed to run your account. Optional analytics and masked session replay require your consent. Change that choice here; browser Do Not Track and Global Privacy Control are respected. Cookie settings.

We do not sell personal data or use your reports to train AI models. AI processing is separate from model training.

Access, export or delete your data

Use the contact details in the Privacy Policy to request a copy, correction or deletion of your data, or account closure. We confirm your identity before acting.

Removing a site stops watching it; it does not erase past scans. Deleted data can remain in backups until those backups are replaced. See the policy for retention details.

View privacy & data · Privacy Policy

Where

Lockpick runs on servers in the United States. It uses a small set of providers to run, for example to host the service and send email, and each one is named in the Privacy Policy.

A share link shows only your score, your grade and the titles of what's worth fixing. The evidence and the fixes stay private, and Stop sharing turns the link off.