Privacy policy

Who runs Supahound?

Supahound is a service of Flywheel Studio LLC, a Texas limited liability company ("Flywheel", "we", "us"). This policy explains what personal data Supahound collects, why, and what you can do about it. Email hello@flywheel.so with any question.

What is our role for each kind of data?

For your account data (your email address, workspace and billing details) we are the controller.

When you connect a Supabase project, its logs can hold personal data about your own users, such as user IDs, IP addresses and email addresses. For that data you are the controller and we are your processor. We process it only to provide Supahound to you. A data processing agreement is available on request.

What data do we collect?

• Account data: your email address, sign-in events, workspace name and team memberships. Sign-in uses one-time email links; we store no passwords.
• Supabase connection data: the OAuth tokens your Supabase org grants us, sealed with a key unique to your workspace. We request the read-only analytics:read, database:read and projects:read scopes only, and never ask for a service-role or secret key.
• Project metadata: project refs and names, and your Row Level Security policy definitions, which tell the detectors who owns which rows.
• Log data: Supahound reads your projects' edge logs through the Supabase Management API to run its detectors. We do not store raw log rows. We store findings and incidents: a pseudonymous actor identifier (such as a user ID), severity, counts, time ranges and structured evidence features such as enums, network ASNs and fingerprints. We never store raw user agents or query values.
• Query records: a list of every query Supahound runs against your project and every model call, kept as hashes and counts, never query results, so you can audit our access.
• Hack me scan data: the domain you scan, the DNS verification records, your acceptance of the scope agreement (who accepted and when), and the scan findings.
• Billing data: Stripe processes payments. Stripe holds your card details; we receive your plan and billing status and never see your card number.
• Website data: the public site sets no tracking or advertising cookies and runs no third-party analytics. Signed-in pages set the cookies needed to keep you signed in. Our hosting provider keeps standard request logs (IP address, time, URL) for security.

How do we use your data?

We do not sell personal data, and we do not share it for advertising.

• To run the posture scan, detectors, incident summaries and alerts you signed up for.
• To send service email: sign-in links, alerts and the weekly digest.
• To bill you and to prevent fraud and abuse of Supahound.
• To secure and improve Supahound. We may compute aggregate patterns across workspaces, such as how often a signal fires per hour of the week. A pattern holds only counts over Supahound's own categories. It never holds a table, column, project, actor, IP address or query value, and we publish one only when at least 10 workspaces contribute.

Does Supahound send my data to AI models?

Supahound uses a language model to write the plain-English summary of an incident. The model receives only that incident's structured features, such as counts, categories and the label "actor A". It never receives user IDs, emails, IP addresses, user agents, query values, raw log text or your workspace name.

Every model call goes through Vercel AI Gateway with zero data retention required and prompt training disallowed. The gateway sends the call only to a provider with a zero-data-retention agreement and fails the call if none is available. The primary model is Anthropic's Claude Haiku; the fallback is xAI's Grok. If both fail, Supahound sends template text instead. We never use your data to train models.

Who processes data for us?

We use these subprocessors. We will update this list before we add a new one.

• Cloudflare, Inc. (United States): hosting, background jobs, database connections and email delivery.
• Supabase, Inc. (United States): Supahound's own database and sign-in.
• Stripe, Inc. (United States): payments and billing.
• Vercel, Inc. (United States): AI Gateway, which routes model calls under zero data retention.
• Anthropic, PBC (United States): incident summaries, under zero data retention.
• X.AI Corp. (United States): fallback incident summaries, under zero data retention.

How do we protect your data?

• Each workspace's data is isolated in the database by forced Row Level Security, and every database session is scoped to one workspace.
• OAuth tokens are encrypted with a key derived per workspace and bound to that workspace and connection.
• Supahound's access to your Supabase org is read-only.
• All traffic is encrypted in transit with TLS.

How long do we keep data?

• Incidents and findings: for the incident history of your plan (30 days on paid plans), then deleted.
• Account data: while your account is open, and deleted within 30 days after you close it, except records we must keep for tax or legal reasons.
• OAuth tokens: until you disconnect the Supabase org or close your account. You can also revoke our access at any time from your Supabase dashboard.
• Scope agreements for hack me scans: kept as an append-only legal record for as long as the law requires us to show that a scan was authorized.

What are my rights?

Depending on where you live (for example under the GDPR, UK GDPR or California law), you may have the right to access, correct, delete or export your personal data, to object to or restrict processing, and to complain to a data protection authority. Email hello@flywheel.so and we will answer within 30 days. If you are an end user of an app that uses Supahound, contact that app's owner first; we will help them answer you.

Where is data processed?

We are based in the United States, and our subprocessors may process data in the United States and other countries. Where the law requires it, we use standard contractual clauses for international transfers.

Children

Supahound is a tool for businesses and developers. It is not meant for anyone under 16, and we do not knowingly collect their data.

Changes to this policy

We will post any change here and update the effective date. For a material change, we will email account owners before it takes effect.