Privacy Policy

Who we are#

Lockpick is operated by datascience2go Inc., based in Ontario, Canada. We are responsible for the personal data this policy describes. Where data protection law uses the term, we are the controller.

This policy covers the Lockpick website, the web app and any API, agent or command-line access we offer. It does not cover the websites you ask us to assess, which have their own policies.

What we collect#

We collect the following, mostly from you and from the sign-in provider you choose.

• Account data. Your name, email address and password, or the basic profile that Google or GitHub shares when you sign in with them.
• Workspace and team data. Workspace names, members, roles and invitations.
• Sites and ownership proofs. The sites you add, and the DNS records or files you publish to prove you control them.
• Reports. Assessment results for your sites, with evidence taken from public information and kept in redacted form.
• Onboarding answers and consent records. What you tell us when you set up Lockpick, and when you accepted our terms or chose to receive product email.
• Usage and billing records. The features you use and the runs you start and, once paid plans launch, your plan, credits and purchases. Card details go to the merchant of record or payment processor, not to us.
• Security and audit logs. Sign-in events, IP addresses, browser details and records of important actions, which we use to keep accounts and Lockpick secure.
• Support email. Messages you send us and our replies.

What an assessment collects#

An assessment reads public information about the site you ask us to check. That means public pages, response headers, scripts, public DNS records, certificate transparency logs and domain registration data. Public pages and registration data can contain personal data, such as a contact name or email address published for a domain. Reports keep evidence in redacted form.

Assessments do not log in, do not submit forms and do not collect data about the people who visit your site.

To check a domain, we query public data sources such as crt.sh, public DNS resolvers such as Google Public DNS, and RDAP registration services. They receive only the domain being checked, never your account details.

A Quick check without an account works the same way. We keep the site address and the result so we can show them to you.

How we use personal data#

• To provide Lockpick, including running the assessments you ask for, showing reports and managing workspaces.
• To confirm that you may test a site, to enforce limits and to prevent misuse, including looking into reports of assessments a site owner did not authorize.
• To keep accounts and Lockpick secure.
• To send service email, such as sign-in, verification, invitation and report email, and product email if you chose to receive it.
• To answer support requests.
• To understand how Lockpick is used and to improve it.
• To handle plans, credits and billing once paid plans launch.
• To meet our legal obligations and protect our rights.

We do not sell personal data, and we do not use your reports to train AI models.

Legal bases for users in the EU and UK#

If the GDPR or the UK GDPR applies to you, we rely on these legal bases.

• Contract, to provide Lockpick under our Terms of Service.
• Legitimate interests, to secure Lockpick, prevent misuse, confirm permission to test and improve the product. We weigh these interests against your rights.
• Consent, for product email and for optional analytics where consent is required. You can withdraw consent at any time.
• Legal obligation, where the law requires us to keep or disclose data.

Cookies and analytics#

We use a cookie to keep you signed in, and Lockpick cannot work without it. If you choose a setting such as a language, we may remember it in a cookie too. We do not use advertising cookies.

Product analytics are optional and off unless we configure them. When they are on, we use PostHog in cookieless mode to count how pages and features are used. Analytics never receive the addresses of the sites you assess.

Who we share data with#

We share personal data only as this policy describes.

• Service providers that run parts of Lockpick for us, under contracts that limit how they use the data. These include hosting (Railway), email delivery (Resend), sign-in (Google and GitHub, when you use them), product analytics (PostHog, if enabled) and, once paid plans launch, a payment processor or merchant of record.
• Public data sources, which receive only the domain being checked, as described above.
• People in your workspace, who can see its sites and reports according to their role.
• Anyone you share a report link with.
• Site owners, authorities or others, when we believe it is needed to prevent misuse or harm, for example when a site owner reports an assessment they did not authorize.
• Authorities or other parties, when the law requires it.
• A buyer or successor, if we are part of a merger, acquisition or sale of assets, subject to this policy.

We do not sell personal data or share it for targeted advertising.

Where data is stored#

Our servers are in the United States. If you live elsewhere, your data is transferred to the United States, and our service providers may process it in other countries. Where the law requires it, we use appropriate safeguards for these transfers, such as standard contractual clauses.

How long we keep data#

• Account data, for as long as your account is active and for a reasonable period after it closes, to handle questions, disputes and legal obligations.
• Reports, until you delete them or your account closes.
• Security and audit logs, for a limited period.
• Billing records, for as long as tax and accounting law requires.

Deleted data can stay in backups for a short time until those backups are replaced.

Security#

We use reasonable technical and organizational measures to protect personal data, such as encrypted connections, access controls and limits on who can see customer data. No system is perfectly secure. If a breach affects your personal data, we will tell you and the authorities where the law requires it.

Your choices and rights#

You can ask us to access, correct, delete or export your personal data, and you can withdraw any consent you have given. Write to us at mark@promptadvisers.com. We may need to confirm your identity first, and we will answer within the time the law requires.

• Canada. Under PIPEDA and provincial privacy laws, you can access and correct your personal data, and you can complain to the Office of the Privacy Commissioner of Canada.
• EU and UK. Under the GDPR and the UK GDPR, you can also object to or restrict some processing, and you can complain to your local data protection authority or, in the UK, to the Information Commissioner's Office.
• United States. Depending on your state, you may have the right to know what personal data we hold about you, to correct or delete it, to get a copy, and to opt out of its sale or its use for targeted advertising. We do not sell personal data or use it for targeted advertising. You can use an authorized agent, and we will not treat you differently for using your rights.

Children#

Lockpick is for businesses and professionals. It is not meant for anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

Changes to this policy#

We may update this policy. The effective date and version at the top of this page show which version applies. If a change materially affects you, we will tell you before it takes effect, by email or in Lockpick.

Contact#

For privacy questions or requests, write to us at mark@promptadvisers.com.

Lockpick is operated by datascience2go Inc., Ontario, Canada.