What we do with your code, plainly

Your code

We keep the problematic code sections until the solution report is provided, or for one week at most. Your repository itself is never stored. We clone or extract your source into a temporary working directory, analyse it, and delete that directory when the scan ends.

The only fragments we keep are the specific lines each finding refers to, because writing a useful fix prompt requires them. Those are deleted as soon as your unlocked report is delivered, or after seven days — whichever comes first. If you unlock a report after that window, the fix prompts are written from the finding metadata alone and will be less specific.

Your report

This page is unlisted, not private: anyone with the link can read it and it is excluded from search engines. We serve a noindex directive and exclude report URLs in robots.txt. Treat the link as the credential it is: anyone you send it to can read the report. Reports and findings are kept indefinitely so the link you share stays alive.

Your email address

Used to send your report link and, if you pay, to tell you when the full report is ready. No account is created. We do not send marketing.

Your IP address is stored only as a salted hash, purely to count scans against the rate limits. The raw address is never retained.

Limits

• 20 MB and 5,000 files of scannable source per repository.
• 50 MB maximum ZIP upload.
• 3 scans per hour and 10 per day per person, plus a daily total across all users so every scan gets a full AI review.

Payment

$49 unlocks one report, once, permanently. It is not a subscription. Payment is handled by Stripe; we never see your card details. If we fail to deliver the explanations and fix prompts you paid for, we refund you without being asked.

Changed your mind for any other reason? Ask within 14 days and we refund you, no questions. A refund returns the report to its free teaser state — you are un-buying it, not keeping it. One no-questions refund per customer; after that we read the request first.

What this is not

A Codanopy report is an automated review, not a security audit or a guarantee. A clean score means we found nothing, not that there is nothing to find. Use it as a first pass, not a certificate.

Deletion requests

Operated from the EU. To have a report and its findings deleted, reply to the email that delivered it and we will remove it by hand.

This page is the short version. The full documents are the Terms of Service and the Privacy Policy, and they are what actually governs your use of Codanopy.