Privacy Policy

Effective date: November 6, 2026 · SF Product Labs LLC

This Privacy Policy explains how SF Product Labs LLC ("EvilPet", "we", "us", or "our") collects, uses, and handles information when you use the EvilPet autonomous security assessment service at evilpet.app (the "Service").

1. Information we collect

• Account information. Your email address (used for passwordless login and domain verification). We do not require or store a password.
• Scan targets. The domains, URLs, or public GitHub repository URLs you submit for assessment.
• Scan results. Findings, subdomains, ports, URLs, and evidence generated during an assessment, retained to support your report.
• Usage data. Minimal, non-identifying telemetry needed to operate and secure the Service (e.g. rate limiting, abuse prevention).
• Payment information. Processed by our payment provider (Stripe). We do not store your full card number — only Stripe IDs and billing status.

2. How we use information

• To run the security assessments you request and deliver reports.
• To verify that you own or are authorized to scan a domain.
• To provide, maintain, and secure the Service, and to prevent abuse.
• To process payments and enforce your subscription or credits.
• To comply with legal obligations.

3. Domain ownership and scanning

By submitting a domain, you confirm that you own it or are authorized to run security tests against it. Assessments are visible to you and, for domains, to other verified users of the same domain. Public GitHub repository scans are shared as described in our pricing and product documentation.

4. Responsible disclosure for GitHub repositories

When an assessment finds vulnerabilities in a public GitHub repository, we follow a timed, responsible-disclosure process consistent with industry best practices. We notify the repository's maintainers privately and allow a short review window — our median disclosure delay is 2 days, based on research into how quickly exploits become available after a vulnerability is known (Householder et al., "Historical Analysis of Exploit Availability Timelines," USENIX CSET 2020) — before the findings and any proposed fix are made public. A short, coordinated window lets maintainers prepare and ship a fix before the finding is widely exploitable, which is how security fixes are normally coordinated with upstream maintainers. The exact window can vary by case, and maintainers may request an extension directly from the disclosure email.

5. Sharing

We do not sell your personal information. We share information only with: (a) payment processors (e.g. Stripe) to process transactions; (b) service providers who help operate the Service under confidentiality obligations; and (c) as required by law or to protect our rights. Public GitHub repository findings are shared per the product's public-repo model.

6. Data retention

We retain scan results and account data for as long as your account is active and as needed to provide the Service, meet legal obligations, and resolve disputes. You may request deletion of your account and associated data by contacting us (subject to retention required by law).

7. Security

We adhere to industry best practices for the collection, storage, and processing of information, and for the security of the Service. Specific safeguards include:

• Isolated execution. Each scan runs in an isolated, resource-limited sandbox with no access to other users' data, our internal systems, or our credentials.
• Encryption in transit. All traffic is served over HTTPS (TLS).
• Access controls. Passwordless session-based authentication, per-user data isolation, and role-based access to operator tooling.
• Secrets management. API keys, tokens, and credentials are never exposed to the scan environment or to other users.
• Rate limiting. Per-IP and per-account limits to prevent abuse and brute-force attacks.

No method of transmission or storage is 100% secure, but we work to protect your information using commercially reasonable measures consistent with industry best practices.

8. Your choices

You may access or update your account information, and request deletion of your data, by contacting us. We honor reasonable opt-out requests for non-essential communications.

9. International transfers

Data may be processed on servers in the United States and other jurisdictions. We apply appropriate safeguards to transfers.

10. Children

The Service is not directed to children under 13, and we do not knowingly collect data from children.

11. Changes to this policy

We may update this policy from time to time. Material changes will be posted on this page with an updated effective date.

12. Contact

Questions about this Privacy Policy? Contact support@evilpet.app.
SF Product Labs LLC, San Francisco, CA.