Privacy Policy
Last updated: 10 September 2026
This policy explains how StackFlag (stackflag.com) collects, uses, and protects your information.
What we collect
Account information: Your email address and a hashed version of your password. Optionally, a display name.
Stack data: The software names, versions, and monitoring rules you define. This is used solely to match vulnerabilities against your stack.
Usage data: Server logs (IP address, browser user-agent, pages visited) for security monitoring, rate limiting, and debugging. We do not use analytics tracking scripts.
Flag and alert history: Records of which vulnerabilities matched your stack, your triage actions (read, acknowledged, dismissed), and notes you add.
Feedback messages: If you use the feedback form, we receive the message content, your email (if provided), and the page you were viewing.
How we use your data
- To provide the service: matching vulnerabilities to your stack, sending alerts, displaying your flag queue.
- To send transactional emails: verification, password reset, alert digests.
- To maintain security: rate limiting, login attempt logging, abuse prevention.
- To improve the service: aggregated, non-identifying usage patterns.
We do not sell your data. We share it only with the providers listed below, and only as needed to run the service, or where required by law.
Who processes your data
| Provider | What they handle | Where |
|---|---|---|
| DigitalOcean | Application and database hosting - your account, stacks and flags | London (UK) |
| Amazon Web Services (SES) | Sending email: verification, password reset, alerts, service notices | United States |
| Cloudflare | DNS and reverse proxy for stackflag.com | Global network |
| An AI gateway operated by us, routing to OpenRouter | AI processing (see below) | Provider varies; restricted to Zero Data Retention providers |
International transfers. Email is sent through Amazon SES in the United States, so the content of an email - your address, the vulnerabilities flagged for you, and the stacks that matched them - is processed outside the UK and EU. AWS operates under UK and EU approved transfer mechanisms including Standard Contractual Clauses. If this matters for your compliance position, say so and we will tell you exactly what an email contains.
AI processing
StackFlag uses a third-party AI service for two things, and they send different data.
Vulnerability summaries. Every advisory we ingest is rewritten in plain English. Only the vulnerability's public title and description are sent - the same text already published by the advisory source. No personal data, no account details, and nothing about which customers track that software.
The stack wizard. If you use the wizard, the description you type is sent so it can be turned into a list of software to monitor. That text is whatever you wrote, so please do not include hostnames, internal addresses, credentials or anything else you would not want to leave your account. You can skip the wizard entirely and add what you monitor by hand.
Data retention at the AI provider. Our AI requests are routed with Zero Data Retention enabled. That restricts processing to providers who have contractually agreed not to store your prompts after answering, and not to use them for training. It is why we route to a deliberately limited set of providers rather than the cheapest or fastest available.
We never send your flags, your alert settings, your email address, or the names of the stacks you monitor.
Data retention
- Account and stack data is retained while your account is active.
- Login attempt logs are retained for 30 days.
- Notification queue records are retained for 14 days.
- If you delete your account, your data is permanently removed within 30 days.
Security
Your data is stored on servers protected by firewall rules, SSH key-only access, and encrypted connections. Passwords are hashed with bcrypt. Sessions use secure, HTTP-only cookies.
Cookies
We use a single session cookie (SF_SESS) to maintain your login. No third-party cookies or tracking cookies are used.
Your rights
You can:
- Access your data through your account settings and stack pages.
- Export your stack definitions and flag history (feature coming soon).
- Delete your account and all associated data via Settings.
- Contact us at [email protected] with any data requests.
Changes to this policy
We may update this policy from time to time. We will notify registered users by email of material changes.
Contact
If you have questions about this policy, email us at [email protected].