What we collect, and why.

Who we are

APPCHK is made by Humanly Systems Ltd (“Humanly”, “we”), United Kingdom. We are the controller of the personal data described here under the UK GDPR and the Data Protection Act 2018 and, for people in the European Union, the EU GDPR. Contact: privacy@appchk.com.

appchk.com

Browsing. The site sets no cookies and runs no analytics or advertising trackers. It is hosted on Cloudflare, which processes technical request data, such as your IP address and browser details, to deliver the site and protect it from attacks. Cloudflare request logs may keep these details for a few days so we can fix problems.

Your theme choice. If you switch between the dark and light theme, your browser remembers the choice in its own local storage. It stays on your device and is never sent to us.

Request access. When you ask for early access we store your email address, the time of the request and the country Cloudflare derives from your connection (not your IP address). We use them to send your invite and occasional updates about your early access.

Contact form. When you send the contact form we receive your name, email address, company (optional), the topic you choose and your message, delivered to our inbox by email. We use them only to reply and to follow up on what you asked about.

Spam protection. Both forms are protected by Cloudflare Turnstile in invisible mode: it runs in the background when you use a form, checks signals from your browser and device to tell people from bots, and shows nothing on screen. Turnstile loads only when you start using a form. It is provided by Cloudflare, Inc., and its processing is described in the Cloudflare Turnstile Privacy Addendum and the Cloudflare Privacy Policy. The forms also contain a hidden field that only bots fill in.

Repeat submissions. After you send a form, we store a keyed one-way hash of your IP address and browser details for 24 hours, so the same browser cannot send that form again within a day. We cannot turn the hash back into your IP address, and it is deleted automatically after 24 hours.

The APPCHK command-line tool

The CLI runs on your own computer or CI runner. It sends us nothing: no builds, no results, no telemetry, no crash reports and no update checks. If you choose to download vulnerability data, your machine fetches public feeds such as OSV and the NVD directly from their publishers. Optional network lookups during a scan are off unless you turn them on.

APPCHK Cloud

During early access, APPCHK Cloud processes your account details (name, email address and organization), the builds you upload, the scan results, and technical logs of your use. It runs on servers operated by Hetzner Online GmbH in the European Union. Builds are used only to run the scans you request and are never used to train AI models. Before you upload a build we tell you how long it is kept; retention settings and the full list of sub-processors will be published before APPCHK Cloud opens beyond early access.

Why we are allowed to use it

We rely on legitimate interests to reply to your messages, handle access requests, keep the site and services secure and free of spam, and keep a record of enquiries. For APPCHK Cloud accounts we rely on the contract between us, and on steps you ask us to take before entering into it.

Who we share it with

We use a small number of service providers who process data for us: Cloudflare (hosting, security, Turnstile, email delivery, and storage of access requests and repeat-submission records), Hetzner (APPCHK Cloud hosting in the EU) and our email provider (to receive your messages). We do not sell personal data or share it with advertisers.

Some providers may process data outside the United Kingdom or the European Union. Where they do, they rely on recognised safeguards such as adequacy decisions, the EU Standard Contractual Clauses or the UK International Data Transfer Addendum.

How long we keep it

Access requests are kept until your invite is sent and for as long as you are interested in APPCHK, and deleted within 24 months of our last contact unless you have an account. Enquiry emails are deleted within 24 months of our last contact unless we are working together or the law requires us to keep them longer. Repeat-submission hashes expire after 24 hours. Cloudflare request logs expire automatically after a few days. APPCHK Cloud data is kept according to your account's retention settings and deleted when you close your account.

Your rights

You can ask for a copy of your personal data, ask us to correct or delete it, ask us to restrict or stop using it, and ask for it in a portable format. Email privacy@appchk.com and we will reply within one month.

If you are unhappy with how we handle your data you can complain to the Information Commissioner's Office in the UK, or to the data protection authority where you live in the EU. We would appreciate the chance to fix it first.

Children

APPCHK is a professional tool and is not aimed at children under 16. We do not knowingly collect their personal data.

Changes

If we change how we handle personal data, we will update this page and the date at the top.