How quietwatch handles your data
Short version: we read public pages the way a crawler does, we hold as little as the service needs, and everything travels over HTTPS.
1. Passive checking only
Every check is a plain HTTP request for something the site already publishes: the page you name, robots.txt, sitemap.xml, llms.txt, the sitemap robots.txt declares, and script files the page references. We never log in, never submit forms, never guess paths and never send a User-Agent other than our own, which names us and gives a contact address. We obey robots.txt on every host.
2. What we store
Checked addresses and results, a salted hash of the requester's address for rate limiting, and for accounts: the email, the sites registered, alert recipients and billing status. Payment details never reach our servers; they are held by the payment processor. The location of a leaked secret found by check 11 is stored for the verified owner's view only and never shown on a public link.
3. Encryption in transit
quietwatch.app is served over HTTPS only, with HSTS, a strict Content Security Policy and no third-party scripts. Connections to the database and to the email provider are encrypted.
4. Sign-in
There are no passwords to leak. Sign-in is a magic link: a single-use link emailed to you that expires after 15 minutes; only a hash of it is stored. Sessions are signed cookies marked HttpOnly, Secure and SameSite, and "Sign out everywhere" invalidates every session at once. Every form is protected against cross-site requests.
5. Where it runs
One application server and a managed database, both with access limited to what operating the service requires. Anonymous results are deleted after 30 days.
6. Responsible disclosure
Found a vulnerability? Write to hello@quietwatch.app with enough detail to reproduce it. We acknowledge within two business days, keep you informed, and do not take action against good-faith research that avoids other people's data and does not degrade the service. Our security.txt carries the same contact.