Privacy Policy

Last updated 24 August 2026

1Who is responsible for your data

The controller of personal data described in this policy is:

• Bc. Bektur Aibekov, trading as Launchprep
• Příčná 1892/4, 110 00 Praha, Czech Republic
• Business identification number (IČO): 29522471
• VAT identification number: not VAT registered
• Contact: hello@launchprep.dev

Where this policy says "we", "us" or "Launchprep", it means the entity above.

2Who this policy covers

This policy applies to visitors to our website, users of the Launchprep command-line tool, and customers who purchase a paid licence. It applies wherever you are located. Additional rights that apply only in certain regions are set out in section 11.

3What we collect, and what we deliberately do not

The free scan: nothing reaches us

The Launchprep command-line tool reads files on your computer and prints results to your terminal. It performs no network requests and transmits nothing. We receive no data at all when you run a free scan — no code, no findings, no telemetry, and no record that a scan happened.

If you buy a licence

Data	Why	Basis
Email address	To send your licence key, receipts, and notices about the service	Performance of a contract
Payment record (amount, date, country, last four digits, processor reference)	To take payment, meet tax and accounting obligations, and handle refunds	Contract; legal obligation
Licence key and activation record	To let your key work, and to apply the scan allowance attached to it	Contract
Scan records (date, rule identifiers, file paths, line numbers, severity)	To produce your report, keep your history, and count usage against your allowance	Contract

How long we keep it. A hosted report and its findings are deleted automatically 90 days after the scan, and its link stops working then. Your email address and licence record are kept while the licence is valid, and payment records for as long as tax and accounting law requires. You can ask us to delete anything sooner — write to hello@launchprep.dev and we will.

We do not store your card details. Payment is handled by our payment processor and card data goes directly to them.

The paid review, and what it sends to Anthropic

Some paid checks cannot be answered by pattern-matching. They need a language model to read the relevant code and reason about it — for example, deciding whether one customer's records can be reached by another. For those checks we use the Claude API, operated by Anthropic PBC, as a data processor acting on our instructions.

What is sent

• Only the parts of your codebase relevant to the checks being run — selected before any check runs, and never your whole repository
• No environment files, no credentials, and no contents of .env. Where a secret is detected, only its location is transmitted, never its value
• Nothing at all if you never run a paid review

What happens to it

• Anthropic processes it solely to return the analysis we requested
• It is not used to train any model. Anthropic's commercial terms exclude API inputs and outputs from model training
• Anthropic may retain inputs and outputs for a limited period for trust, safety and abuse monitoring, after which they are deleted
• We do not store the excerpts ourselves. Once the analysis returns, we keep only the findings — rule identifier, file path, line number, severity — and discard the code
• Processing may take place in the United States. Transfers rely on Standard Contractual Clauses

You control when this happens. It occurs only when you explicitly run a paid review on a project you choose, and never during a free scan.

If your code cannot leave your machine under any circumstances — a client contract, a regulated environment — you can run the paid checks through your own Claude subscription inside your editor instead. Nothing then reaches either Anthropic through us, or us.

Website

Our hosting provider records standard server logs, including IP address and browser type, for security and reliability. These are kept for 30 days. Cookies are covered in section 4.

4Cookies and local storage

A cookie is a small file a site stores in your browser. Local storage is similar, but stays on your device and is never sent to a server. This website uses neither. It loads no third-party scripts, and every font and image is served from our own domain — so no other company learns that you visited, or when.

One exception exists, and only if you decide to buy: our payment provider sets a session cookie so your purchase can complete. That happens on Stripe's own checkout page rather than here, and only after you choose to pay.

What we never do

• No advertising cookies, no retargeting, no advertising-network pixels
• No cross-site tracking and no data brokers
• No advertising or behavioural analytics, and nothing that follows you off this site
• No selling or sharing of personal data, in any jurisdiction's sense of those words

The one thing we do count

An earlier version of this page said that if we ever added analytics it would be a cookieless tool that counts visits without identifying anyone, and that this section would say so before it was switched on. It is switched on, and this is that notice.

We run Umami, an open-source analytics tool, on our own server. It is not Google Analytics and it is not a third-party service: the script is served from this domain, the numbers are stored on our own database, and no other company receives anything.

What it records	What it does not
Which page was viewed, and when. Which site linked you here. Country. Browser, operating system and whether you are on a phone or a desktop. Screen size.	No cookies. Nothing written to your device. No name, no email, no account. Your IP address is used to work out the country and then discarded — it is never stored.

Visits are grouped into a session using a value derived from your address and browser, mixed with a secret that changes every day. That means we can tell that one person looked at three pages, and we cannot tell that it was the same person yesterday, or on any other website. Nobody can work backwards from it to you.

This is why there is still no consent banner. Consent is required for storing or reading information on your device, and this stores nothing. Regulators treat properly configured audience measurement of this kind as exempt. If we ever adopt something that does need your permission, we will ask for it rather than assume it.

5Who else processes your data

We use a small number of providers to run the service. Each is bound to process data only on our instructions.

Provider	Purpose
Stripe Payments Europe, Ltd.	Payments, invoicing, and tax handling
Resend (Plus Five Five, Inc.)	Licence keys, receipts, service notices
Railway Corp.	Website and application hosting
Anthropic PBC (Claude API)	Analysis of code excerpts during a paid review. Does not train on submitted data

We do not sell personal data, and we do not share it for advertising.

6International transfers

Our providers may process data outside your country, including outside the European Economic Area. Where that happens we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses or an adequacy decision. You can request details of the safeguards used by contacting us.

7How long we keep it

• Code excerpts sent for a paid review — deleted once the review completes
• Scan records and reports — kept while your licence is active, then 12 months, unless you delete them sooner
• Account and email — kept while you hold a licence, then 12 months
• Invoices and payment records — kept for the period required by tax law, which is 10 years in our jurisdiction

8Security

We use encryption in transit, restrict access to production systems to those who need it, and keep the volume of data we hold deliberately small. The most effective protection is architectural: the free tool cannot transmit anything, and the paid review transmits excerpts rather than repositories.

No system is perfectly secure. If a breach affects your personal data and is likely to result in a high risk to you, we will notify you and the relevant supervisory authority as required by law.

9Your rights

Subject to your local law, you may ask us to:

• confirm what personal data we hold about you, and give you a copy
• correct data that is wrong or incomplete
• delete your data
• restrict or object to how we use it
• provide it in a portable, machine-readable format
• withdraw consent, where we relied on consent

Write to hello@launchprep.dev. We reply within one month. There is no charge unless a request is manifestly unfounded or excessive.

10Children

Launchprep is a developer tool and is not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child has provided us data, contact us and we will delete it.

11Regional rights

European Economic Area and United Kingdom

We process personal data under the GDPR and the UK GDPR. The legal bases we rely on are given in section 3. You have the right to lodge a complaint with your local supervisory authority. Ours is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), uoou.gov.cz.

California

Under the CCPA as amended by the CPRA you may request disclosure of the categories and specific pieces of personal information we have collected, request deletion or correction, and opt out of sale or sharing. We do not sell or share personal information, and we do not use it for cross-context behavioural advertising. We will not discriminate against you for exercising these rights.

Elsewhere

If your local law grants you rights beyond those in section 9 — including under Brazil's LGPD, Canada's PIPEDA, or Australia's Privacy Act — we will honour them. Contact us and say which law you are relying on.

12Changes

If we change this policy we will update the date at the top. For changes that materially affect your rights, we will email licence holders before the change takes effect.

13Contact

Questions about this policy or your data: hello@launchprep.dev, or write to us at Příčná 1892/4, 110 00 Praha, Czech Republic.