What does Canary check?

Your homepage, sign-up and login pages and their forms, and that your checkout link or script is reachable. Checks are read-only: no real accounts or payments are created.

Does it work with apps built in Lovable, Bolt, Cursor, Replit or Claude?

Yes. Canary checks the live app at its public URL, so it works no matter which tool built it.

How often are apps checked?

Free checks one app once a day. Starter checks one app every hour. Pro checks up to 5 apps every hour.

Does Canary create accounts or make payments?

No. Checks are read-only: Canary confirms pages and forms load and that checkout is reachable. It never submits real sign-ups, logins or payments, and needs no passwords.

When do I get alerted?

Right away if the first check of your app fails. After that, after 2 failed checks in a row, and once more when it recovers.

A screenshot, the exact error, a plain-English explanation and a fix prompt you can paste into your AI builder.

Is the security scan safe?

Yes. It only reads what your site already shows to every visitor, such as exposed keys, open files and missing headers. It never attacks your app.

Do I need to install anything or give you access?

No. Paste your public URL. No code snippet, no repo access, no passwords. Canary looks at your live app the way a new visitor does.

What if Canary gets it wrong?

Alerts only fire after a failure is confirmed, and every alert shows the screenshot and the exact error, so you can judge it in seconds. Reply to any alert and a human reads it.

We store your email, your app URL and check results. We never store passwords or your users' data. You can delete everything from your dashboard in one click.

Can I cancel anytime?

Yes. Cancel from the customer portal and you move back to the Free plan at the end of your billing period.

Legal

Privacy Policy

Draft: this policy is not final yet and is shown for transparency. Questions? hello@trycanary.net

DRAFT. Not legal advice. This document must be reviewed by a qualified lawyer (including under the Israeli Protection of Privacy Law, 5741-1981 and its regulations, and the GDPR/UK GDPR if you serve users in the EU/UK) before publication. Placeholders in {{DOUBLE_BRACES}} must be completed.

Last updated: {{EFFECTIVE_DATE}}

1. Who is responsible

This policy explains how {{COMPANY_NAME}} ("Canary", "we", "us"), {{ADDRESS}}, Israel, collects and uses personal data when you use the Canary website at {{SITE_URL}} and related services (the "Service"). We are the controller of the personal data described here, except where stated otherwise (see "Payments" below). Contact: {{PRIVACY_EMAIL}}. {{DPO_OR_EU_UK_REPRESENTATIVE}}

2. What we collect

Information you give us

Email address, when you start free monitoring, unlock a security report, request a dashboard login link, or subscribe.
App URLs you submit for a free check, security scan or monitoring.
Slack webhook URL, if you connect Slack alerts on the Pro plan.
Messages you send to support.

Information generated by the Service

Check results for the URLs you submit: scores, pass/fail results, HTTP status codes, timings, URLs of sign-up, login and checkout pages, and JavaScript error messages from the browser console.
Screenshots of failing steps of a monitored app, stored so they can be shown in alert emails.
Security scan reports: findings such as security header status, exposed files and masked fragments of any keys found (first 6 and last 4 characters only). For the Supabase check, our scanner requests at most one row from each publicly exposed table using the app's public key in order to determine whether the table is readable; we record only the names and number of readable tables and do not store or display the row contents.
Usage events: records such as "check run", "scan run", "signup", "checkout clicked" and "paid", which may include your email, the app URL, plan and score.
Login data: one-time login tokens (stored only in hashed form, expiring after 20 minutes) and a session cookie.

Information from payments

When you subscribe, our payment provider Lemon Squeezy sends us subscription details: your email, Lemon Squeezy customer and subscription identifiers, the plan purchased, subscription status and whether it is a test transaction. We do not receive your full payment card details.

Technical data

Your IP address is used temporarily to apply hourly rate limits on free checks and scans; {{IP_RATE_LIMIT_STORAGE_STATEMENT}}.
Our hosting provider and analytics tool process technical data such as IP address, browser type, pages visited and referrer (see Sections 5 and 6).

Data about third parties. Pages we check may contain information that the site publicly shows to any visitor, which may appear in screenshots or error messages. You should only submit apps you own or are authorized to test (see our [Acceptable Use Policy](acceptable-use-policy.md)).

3. How we use personal data, and legal bases

To provide the Service (run checks and scans, monitor apps, send alerts, reports and login links, show your dashboard): performance of our contract with you.
To manage subscriptions and billing with Lemon Squeezy: performance of contract; legal obligations (tax and accounting).
To prevent abuse and keep the Service secure (rate limits, investigating unauthorized scanning): our legitimate interests.
To understand and improve the Service (usage events, aggregate analytics): our legitimate interests.
To send product news and marketing emails: your consent, where required by law (including the Israeli Communications Law (Telecommunications and Broadcasting), 5742-1982, section 30A). You can unsubscribe at any time. {{MARKETING_CONSENT_MECHANISM}}
To comply with law and respond to lawful requests: legal obligation.

We do not sell your personal data. We do not use your data to train AI models. Alerts and fix prompts are produced from fixed templates, not by sending your data to an AI provider.

4. Payments: Lemon Squeezy as Merchant of Record

Paid plans are sold by Lemon Squeezy, which acts as reseller and Merchant of Record. Lemon Squeezy collects and processes your billing details (name, card or other payment details, billing address, tax information) as an independent controller under its own privacy policy: {{LEMON_SQUEEZY_PRIVACY_URL}}.

5. Who we share data with

We share personal data only with service providers that help us run the Service, under appropriate agreements, and only as needed:

Vercel: website and application hosting, server logs, and Vercel Web Analytics.
Neon: database hosting (stores the data described in Section 2).
Resend: delivery of alert, report and login emails.
ActiveCampaign: mailing list management for email addresses entered for free monitoring.
Lemon Squeezy: checkout, payments, receipts, tax, subscription management.
Headless browser infrastructure: {{BROWSER_PROVIDER}}, used to load the pages of the apps you submit.
Google Fonts: our pages load fonts from Google's servers, which receive your IP address and browser information.
Slack: only if you connect a Slack webhook, alert messages are sent to your Slack workspace.
{{OTHER_SUBPROCESSORS}}

We may also disclose data if required by law, to protect rights and safety, or as part of a merger, acquisition or sale of assets.

6. Cookies and similar technologies

canary_session: a strictly necessary, HttpOnly cookie that keeps you logged in to the dashboard for up to 30 days. It is set only if you log in.
Browser local storage (canary:lastUrl): remembers the URL of your last free check so it can be attached to your subscription at checkout.
Vercel Web Analytics: used to measure page visits. {{VERCEL_ANALYTICS_COOKIE_STATEMENT}}

We do not use advertising cookies. {{COOKIE_CONSENT_REVIEW}}

7. International transfers

Our service providers may process data outside Israel and outside your country, including in the United States. Where required, we rely on appropriate safeguards (such as the European Commission's Standard Contractual Clauses, or transfer mechanisms permitted under the Israeli Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 5761-2001). {{DATA_HOSTING_REGIONS}}

8. How long we keep data

As a guide, we keep account and monitoring data while your account or monitoring is active, and delete or anonymize it within {{DELETION_PERIOD}} after you ask us to delete it or your account becomes inactive, unless we must keep it longer to meet legal, tax or accounting obligations or to resolve disputes.

9. Security

We use measures appropriate to the nature of the data, including encrypted connections (HTTPS), hashed login tokens, signed session cookies, verification of payment webhooks and restricted access to production systems. No system is perfectly secure. {{DATABASE_REGISTRATION_AND_SECURITY_REGULATIONS_REVIEW}}

10. Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict certain processing, to withdraw consent at any time, and to lodge a complaint with a data protection authority (in Israel, the Privacy Protection Authority; in the EU/UK, your local supervisory authority). Under the Israeli Protection of Privacy Law you have the right to review and request correction of information about you held in a database. To exercise your rights, email {{PRIVACY_EMAIL}} from the email address you use with Canary. We will respond within {{RIGHTS_RESPONSE_PERIOD}}.

11. Children

The Service is not directed to children under {{MINIMUM_AGE}}, and we do not knowingly collect their personal data.

12. Changes

We may update this policy. If changes are material, we will notify you by email or on the site before they take effect. The "Last updated" date shows the latest version.

13. Contact

{{COMPANY_NAME}}, {{ADDRESS}}. Privacy questions: {{PRIVACY_EMAIL}}. General: {{CONTACT_EMAIL}}.