Privacy Notice

Security Checkup answers

Your environment selections, answers, and exclusion explanations are processed in the current browser tab to generate your action plan. The checkup does not send these entries to our server or save them in cookies, local storage, or session storage. No account or evidence upload is required.

Refreshing, closing, or leaving the checkup may clear your progress. We do not hold a server-side copy of your answers to retrieve later. Do not enter names, passwords, customer information, or confidential technical details.

Reports you download or print

JSON reports are generated in your browser. Printing or saving a PDF uses your browser’s print tools. These reports can include your environment choices, answers, exclusion explanations, and recommended actions.

You control where you save or share a report. Protect it as potentially sensitive information. Downloads, cloud-synced folders, backups, and printers may retain copies under their own settings. Deleting a report from one location does not necessarily remove those copies.

Website requests and hosting

Loading pages and using site features sends normal web requests through our hosting and security providers. Technical information can include your IP address, requested URL, request time, and browser information. This processing supports delivery and protection of the site and is separate from your checkup answers.

Our hosting provider also runs a browser-based performance and page-visit measurement script. It sends page and performance information to that provider, but does not read your Security Checkup answers or browser storage. The provider retains unsampled measurements for seven days, then keeps a reduced, aggregated set for longer-term statistics. We can access up to six months of these statistics. This does not make all website requests anonymous: the provider separately processes technical requests to deliver and protect the site.

Vulnerability searches and threat headlines

Unlike checkup answers, vulnerability search keywords and filters are sent to our server in a request URL. The server sends relevant search parameters to NIST’s National Vulnerability Database to obtain results. Those requests may be present in service logs or caches. Search only for public product names or vulnerability identifiers, not confidential information.

Threat headlines are retrieved by the server from external news feeds. Opening an article or another external link takes you to a separate provider with its own privacy practices.

Cookies, analytics, and retention

The current application code does not add advertising trackers or store checkup answers in browser storage. The performance measurement script does not use browser cookies or local storage. Hosting and security features may process requests separately, so we are not making a site-wide “no cookies” or “no data collection” claim.

Checkup progress is temporary browser state; downloaded reports remain wherever you save them until you remove them. Performance measurements follow the periods described above. Other hosting and security records follow the provider’s operational retention policies, which can differ by record type; we do not claim that all request metadata is deleted after seven days.

Privacy questions and updates

Email privacy questions to privacy@purposefulsecurity.com. Email messages include information supplied by the sender, such as an email address, display name, subject, message content, and any attachments. Our email service provider processes these messages. We keep them while handling the request and any needed follow-up, then review them for deletion. Deleted messages may remain in the provider’s recovery systems for a limited time.

We use contact email to read and respond to the request, investigate corrections, and maintain the site. You can use the privacy address to ask about, correct, or request deletion of a message you sent. We may need to confirm that you control the sending address before acting, and some records may need to be kept for legal or security reasons. We cannot retrieve checkup answers that were never sent to us.

Do not send passwords, recovery codes, completed assessment files, confidential logs, customer information, or other sensitive technical details. Contact email is not linked to Security Checkup answers.

This notice will be reviewed before introducing accounts, saved results, contact forms, analytics changes, or automated evidence collection. Changes will be reflected in the date at the top of this page.