Privacy Policy

Last updated: October 14, 2026

CobwebCheck is operated by Ritzy Labs LLC, a North Dakota limited liability company. Contact: [email protected].

What we collect

• Waitlist: your email, the optional number of side projects you entered, the referral tag (for example ?ref=) you arrived with, the referring page, and your approximate country (from Cloudflare).
• Connected accounts: project metadata we read with read-only access, such as project and repo names, last activity dates, deployments, domains, and usage or cost figures where available. We do not read your source code contents.
• Account: you sign in with GitHub. We store your GitHub numeric user ID and username, when the account was created and when you last signed in. Everything we store for you is tied to this account and only visible to you.
• Session: one strictly-necessary cookie (HttpOnly, Secure) holding a random sign-in token; we store only a hash of it. It expires after 14 days or when you sign out. A short-lived cookie protects the GitHub sign-in step.

Repository files

GitHub’s “Contents: read” permission technically allows reading files in the repositories you select. CobwebCheck uses it only to read these named files, to detect which services a project uses: package.json, requirements.txt, pyproject.toml, go.mod, Gemfile, .env.example, .env.sample, vercel.json, fly.toml, render.yaml, railway.json, railway.toml, wrangler.toml, wrangler.json, wrangler.jsonc, Dockerfile, docker-compose.yml, firebase.json, serverless.yml, supabase/config.toml, prisma/schema.prisma, README.md, Procfile, Makefile, deploy.sh, scripts/deploy.sh, compose.yaml, docker-compose.yaml, fastlane/Fastfile, fastlane/Appfile, ExportOptions.plist, ios/ExportOptions.plist, Podfile, ios/Podfile, codemagic.yaml, bitrise.yml, main.tf, terraform/main.tf, infra/main.tf, ansible.cfg, inventory, inventory.ini, hosts, playbook.yml, ansible/inventory, ansible/hosts, server.properties, server.cfg, Game.ini, ServerSettings.ini, .github/workflows/*.yml (workflow files only), *.tf files in the repo root. We also note folder names in the repo root (for example an Xcode project folder). We never read your source code or real .env files, and we store only the detected service and infrastructure signals (for example “Hetzner detected in README.md” or a server IP address), not file contents.

Access tokens

Tokens from GitHub, Vercel or other services are used during the connection to read your data. They are not stored afterward.

Optional API keys

If you choose to add an OpenAI or Anthropic Admin key to see real AI spend, we validate it with one read-only request, then store it encrypted (AES-256-GCM, with an encryption key held only as a server secret) and tied to your CobwebCheck account. We use it only to read cost reports and your project/workspace names. We never show the key back, never share it, and you can remove it anytime from the CobwebCheck app, which deletes it immediately. These Admin keys can't be limited to read-only by the provider, so only add one if you're comfortable; you can also revoke it at the provider at any time. Keys are not removed by the 30-day report cleanup; they stay until you remove them or ask us to delete your data.

Bank and card statements (optional)

If you upload a bank or card statement CSV, it is processed in memory on our server. We keep only recurring tech charges (for example a monthly Hetzner or GoDaddy charge): the merchant name, a short descriptor, cadence, average and last amount, last charge date and count. Every other transaction (groceries, rent, transfers, income, one-off purchases) is discarded immediately and never stored. The uploaded file itself is never stored. We also store your choices (assign a merchant to a project, or hide it). This data is tied to your CobwebCheck account and stays until you click Delete all bank data in the app (which deletes it immediately) or ask us to delete it.

Bank connection (beta, invite-only): if you connect a bank through our provider Teller, Teller gives us a read-only access token, which we store encrypted (AES-256-GCM). We use it only to read transactions and apply the same rule: recurring tech charges are kept, everything else is discarded. Disconnecting revokes our access at Teller and deletes the token and every charge from that bank.

Stripe revenue (optional, read-only)

If you connect your own Stripe account through the CobwebCheck Stripe App, Stripe shows you the read-only permissions first (payments, invoices, subscriptions, products, prices, webhook endpoints). We store a refresh token encrypted (AES-256-GCM) and use it only to read the last 90 days of activity to show revenue, active subscriptions and last payment date per project. We never create, change or refund anything, and we do not store your customers' names, emails or card details (only counts). Disconnect in the app to delete our token, and uninstall the app in your Stripe Dashboard to revoke access completely.

Page views (optional)

When you connect Vercel we read page-view totals from Vercel Web Analytics for your projects. If you add a Plausible or PostHog read key, it is stored encrypted and used only to read page-view totals by domain. We store only the totals (last 30 days and the 30 days before).

Payments to CobwebCheck

If you buy a paid plan, payment is handled by Stripe. We never see or store your card number; we store your Stripe customer and subscription IDs, plan and status to unlock your report.

How we use data

We use your data only to produce your report, send you emails you signed up for (like launch invites or monthly reports), and operate and improve the service.

Retention

Report data is kept only as long as needed to show you your report, and we delete it within 30 days. If you have an account, we keep it until you delete your account. If you mark a domain's renewal status in your report (for example “Auto-renew is off”), we keep that small note (your account, the domain name, its expiry date and your choice) so it carries across scans. It is removed when you click Undo, when the domain's expiry date changes, or when you ask us to delete it. Bank and card data is kept as described above until you delete it. Waitlist entries are kept until launch or until you ask us to remove them.

Sharing

We do not sell or rent your data. We share it only with the infrastructure providers that run the service (such as Cloudflare for hosting and storage, Teller if you connect a bank in the beta, and Stripe to process payments if you pay), or when the law requires it.

Your choices

You can revoke access anytime from GitHub or Vercel, and delete all bank/card data in the app with one click. Account → Delete account deletes your account and everything we store for you immediately (reports, connections, keys, bank data, choices), revokes bank connections and cancels any CobwebCheck subscription. Sign out everywhere ends all your sessions. Email [email protected] to access or delete your data, and we'll respond within 30 days.

Changes

We'll post any updates to this policy on this page.