Privacy Policy

1. Introduction

HeaderHawk ("we", "our", "us") is committed to protecting your privacy. This policy explains how we collect, use, and safeguard your information when you use our client-side security monitoring service: the Content Security Policy (CSP) and other Reporting API reports browsers send us about your pages, the script integrity hashes among them, and the scans we run of the pages you designate.

2. Information We Collect

Account Information

When you create an account, we collect:

• Email address
• Name (optional)
• Organization name
• Authentication credentials (managed by our auth provider)

CSP Report Data

When you configure your sites to send reports to HeaderHawk, we receive:

• CSP violation details (blocked URI, violated directive, etc.)
• Document URL where the violation occurred
• The referring URL, where the browser sends one
• Browser and user agent information
• The IP address the report was sent from, stored with the raw report
• Timestamps
• For network error and crash reports: the URL of the request that failed or the page that crashed, the error or crash reason, timings, the address of your server the browser was trying to reach, and a stack trace where the browser sends one

CSP reports may contain URLs from your users' browsers. We do not use this data to track individual users, and we do not sell or share it. It is deleted on the retention schedule for your plan.

Site Scanner

The free site scanner fetches the URL you enter once, from our servers, and keeps the scanned host and path, its redirect chain, its response headers with every cookie value removed, and the findings, for 30 days at a link only you are given. Your IP address is held in a rate-limit counter for ten minutes and is not stored with the result. We also record one anonymous line per scan (the host, the grade and how many findings of each severity) so we can see how many scans run and what they grade. That line carries no path, no headers and no address, is tied to no account, and is kept for a year. It does carry the stored result's id, so HeaderHawk staff can open that result from our internal console for the 30 days it is kept.

It also asks hstspreload.org whether the host that answered is on the browser HSTS preload list. The hostname is all that is sent, it is sent to nobody else, and an outage there only means the result says nothing about the list.

Scheduled Scans

On the Professional plan and above, each page you mark with a scan URL is fetched from our servers once a day. We keep each scan's URL, grade and findings, and the security headers the page sent, with every cookie value removed, for your plan's report retention period, and they are deleted with the page or the account. Like the free scanner, a scan asks hstspreload.org whether your host is on the preload list.

Captured Scripts

On the Professional plan and above, when a site with payment pages reports a version of a script we have not seen it report before, or its daily scan finds one, our servers fetch that script's URL once, as it was reported, query string included, and keep the file if it matches the version that was reported. The file is third-party code retrieved from a public URL, not information about your visitors; it is stored under its own fingerprint, with no account, site or URL attached, and shared by every account whose site ran the same file. We keep a record of each attempt against your site, with the URL fetched, and of who in your account downloaded a copy and when. A script URL that carries something about a visitor in its query string is kept in that record as it arrived. Copies are kept for twelve months from capture, then deleted, and sooner once no site that reported them remains.

Hash Generator

Text you paste and files you choose are hashed in your browser and are not sent to us. If you press Fetch and hash, the URL you entered is sent to our servers, which fetch that file once and return its digests and whether it can be integrity-checked. No result is stored and there is no link to one: the digests are computed, returned and forgotten, and the file itself is never written down. The hostname you asked us to fetch appears in our request logs, like every other request to our APIs, on the retention schedule below; the rest of the URL does not. Your IP address is held in the same rate-limit counter as the scanner's, for ten minutes.

Payment Information

For paid subscriptions, payment details are collected and processed by Stripe. We do not store credit card numbers on our servers.

Usage Data

We collect anonymized analytics about how you use our service, including pages visited and features used.

Our content delivery network also keeps a request log of this site and the documentation site, on the retention schedule below. Each line records the page asked for, the response code, whether the edge served it from cache, the browser or crawler that asked, and the site that linked to it. It holds no IP address and no cookie, and we use it to count which search engines and AI assistants read these pages.

3. How We Use Your Information

We use your information to:

• Provide and maintain the HeaderHawk service
• Process your CSP reports and display analytics
• Send service-related notifications
• Process payments for paid subscriptions
• Improve our service based on usage patterns
• Respond to support requests
• Detect and prevent abuse

4. Third-Party Services

We use the following third-party services to operate HeaderHawk:

Each service has its own privacy policy governing their use of data. The security page lists what each one receives and the region it runs in, with the date the list was last reviewed.

5. Data Retention

We retain your data according to these guidelines:

• Account data: Retained while your account is active, deleted within 30 days of account closure. Two records are kept: that your email address has used a free trial, so a trial is not taken twice, and the record of changes HeaderHawk staff made to your account
• CSP violation reports: Retained for your plan's retention window (15 days on the Free plan, 30 on the Team plan, and 90 on the Professional plan and above), then deleted from both the raw report store and the analytics store
• Script integrity reports: Retained on the same schedule as violation reports (15 days on the Free plan, 30 on the Team plan, and 90 on the Professional plan and above)
• Scheduled scans: Retained on the same schedule as violation reports. Scans run only on the Professional plan and above, where that is 90 days
• Captured scripts: Twelve months from capture, on the Professional plan and above. The record of who downloaded a copy is kept for as long as the account
• Payment records: Retained for 7 years for tax and legal compliance
• Site scanner results: Retained for 30 days, then deleted. The anonymous line recording that a scan happened, and what it graded, is kept for a year
• Usage logs: Retained for at most 90 days

6. Data Security

We implement appropriate technical and organizational measures to protect your data:

• Data encrypted in transit (TLS) and at rest
• Access controls and authentication requirements
• Regular security assessments
• Incident response procedures
• Staff access that is recorded: HeaderHawk staff can view your dashboard as one of your members to answer a support question, but only read-only, for at most 30 minutes at a time, and only with a written reason that is kept with the name of the person who viewed it

7. Your Rights

You have the right to:

• Access: Request a copy of your data
• Correction: Update inaccurate information
• Deletion: Request deletion of your account and data
• Portability: Receive a copy of your data. HeaderHawk has no export or download feature, so this is fulfilled by hand from the stores described on the security page
• Object: Opt out of certain data processing

To exercise these rights, contact us at privacy@headerhawk.com.

8. Cookies

We use cookies for:

• Authentication: To keep you logged in
• Preferences: To remember your settings (e.g., dark mode)
• Analytics: To understand service usage (via Umami, privacy-focused)

We do not use cookies for advertising or tracking across websites.

9. International Data Transfers

Our services are hosted in the United States. If you access HeaderHawk from outside the US, your data will be transferred to and processed in the US. We use standard contractual clauses and other safeguards for international transfers where required.

10. Children's Privacy

HeaderHawk is not intended for use by children under 16. We do not knowingly collect information from children. If we learn we have collected data from a child, we will delete it promptly.

11. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of material changes via email or through the service. The "Effective" date at the top indicates when the policy was last updated.

12. Contact Us

For privacy questions or concerns, contact us at:

• Email: privacy@headerhawk.com