Privacy
What we collect, and what we don't.
Last updated 12 November 2026.
This website
This site sets no cookies, runs no JavaScript, loads
no fonts, scripts or images from third parties, and carries
no analytics of any kind. Its content security policy is
default-src 'none' — the page is not permitted to contact any other host,
and it does not.
No account is created, no identifier is stored in your browser, and nothing you do on this page is recorded by us. Our hosting provider processes ordinary server request logs (IP address, timestamp, requested path, user agent) for delivery, security and abuse prevention. We do not use those logs to build profiles.
When you contact us
If you email us, we hold that correspondence and anything you attach for as long as needed to respond and, where an engagement follows, for the duration of that engagement and any period we are contractually or legally required to retain it.
Mail is handled by Google Workspace. Please do not email credentials, findings or other sensitive material in the clear — ask us and we will arrange an encrypted channel first.
If you message us on WhatsApp, the message passes through WhatsApp (Meta), a third party with its own privacy terms. We use it only for first contact and scheduling; please do not send findings, credentials or client material there. Clicking the WhatsApp link on this site is the only point at which your browser contacts WhatsApp; the site itself loads nothing from it.
If we contact you first
When we write to a company that has not contacted us, we use only business contact routes the company publishes itself (a contact page, a published address or a public register). We say where we found them. We keep the minimum needed to manage the conversation, such as the company, a role and the date, and we do not buy contact lists. Every first message offers an opt-out; if you ask us to stop, we stop and do not write again without a new reason. You may also ask what we hold and ask for it to be deleted, at the address below.
Client engagement data
- Scope, credentials, findings and evidence are held only as long as the engagement requires, and destroyed on request afterwards.
- Findings and evidence are encrypted at rest and are never shared with third parties.
- Client source code and scope material are never sent to third-party model or analysis services.
- We do not publish client names, and we do not reference an engagement publicly without written permission.
- A mutual NDA is signed before you share code, configuration or findings, and before scoping if you ask.
Legal basis and your rights
Where the GDPR or a comparable regime applies, we process correspondence on the basis of legitimate interest in responding to an enquiry, and engagement data on the basis of contract. You may ask what we hold about you, ask for it to be corrected, or ask for it to be deleted where no legal or contractual obligation requires us to keep it.
Contact
Privacy requests and questions: research@deebug.io.
Vulnerability reports about our own systems go to security@deebug.io — see security.txt.