The short version: we read your code as text to scan it, we never run it, and whatever we clone or extract gets deleted from our servers the moment the scan finishes — success or failure. The rest of this page explains exactly what that means and what else we collect.
Who we are
FixBrokenApp ("we", "us") is a service that reviews AI-generated applications (built with tools like Cursor, Lovable, Bolt, Replit, v0, Windsurf, GitHub Copilot, and Claude Code), reports on what's broken or insecure, and — if you choose to hire us — fixes it. This policy covers the free scanner, the report pages it generates, our marketing site, and our admin systems.
What we collect
We collect different things depending on how you use the site:
When you run a free scan
- The source you submit — a public GitHub repository URL, a direct link to a zip file, or a zip you upload directly.
- Your IP address, recorded against the submission, used only for rate-limiting abuse (e.g. capping how many scans one visitor can start in a short window) and security investigation if needed.
- The scan results — the findings our scanner produces (what's broken, what's insecure) and a readiness score, stored so we can show you your private report.
When you contact us or become a client
- Whatever you tell us over WhatsApp or email — typically your name, project details, and what you need fixed.
- If you become a paying client, our team may record project notes and progress details inside our admin system to deliver the work.
Automatically, from everyone
- Standard web server logs (IP address, browser type, pages visited, timestamps) — used for security and diagnosing problems, not for tracking you across the web.
- A session cookie and a CSRF-protection cookie, both required for the site to function securely (see "Cookies" below).
What actually happens to your code
This is the part most people care about most, so we're being specific rather than vague:
- When you submit a GitHub URL, our scanner clones it into a temporary directory on our server.
- When you submit a zip (uploaded directly or via a link), it's downloaded/extracted into a temporary directory.
- The scanner then reads every file as plain text — checking for things like committed secrets, insecure patterns, and missing security controls. Nothing in your project is ever executed, compiled, or run.
- Once the scan finishes, the temporary directory — the clone, the extracted files, everything — is permanently deleted, whether the scan succeeded or failed. This happens automatically, not on request.
- An uploaded zip file itself (before extraction) is also deleted from our server as soon as the scan that used it finishes.
- We do not keep a copy of your source code anywhere, and we do not use it to train any AI model.
We do keep the findings from the scan (e.g. "a Stripe secret key was found hardcoded in .env") — that's the report we show you. We do not keep the underlying file contents that produced that finding.
Your report and how long we keep it
- Every scan produces a private report at an unguessable URL (a long random token, not something that can be found by browsing or searching).
- Free scan reports are automatically deleted after a set number of days (currently 30 days) unless you've become a paying client, in which case the report is kept as a record of the work.
- Some reports may optionally be protected with a 4-digit PIN you set; we store that PIN in hashed (not plaintext) form, the same way we'd store a password.
- You can request early deletion of any report at any time — see "Your rights" below.
Cookies
We use two functional cookies, both strictly necessary for the site to work:
- Session cookie — keeps you logged in (admin) or remembers report-unlock state (PIN-protected reports).
- CSRF token cookie — a security measure that prevents other websites from submitting forms on your behalf without your knowledge.
We do not use advertising cookies, third-party tracking pixels, or cross-site analytics cookies.
Who we share data with
We don't sell your data. A small number of infrastructure providers process data on our behalf so the service can run:
- Hosting provider — runs the servers the app and scanner operate on.
- Amazon Web Services (S3) — if enabled, stores site media (logos, blog and case-study images) — never your submitted source code, which always stays on local server storage during a scan and is deleted immediately after.
- GitHub — when you give us a GitHub URL, we contact GitHub's public servers to clone it, the same way anyone browsing that repo would.
- WhatsApp / Meta — if you contact us via the WhatsApp button, your conversation is subject to WhatsApp's own privacy policy as well as ours.
Security
- Uploaded files and cloned repositories are never placed anywhere publicly reachable — they live in a private area of our server that isn't served over the web, and are deleted immediately after scanning.
- Remote zip URLs are validated to prevent our server from being tricked into fetching internal/private network addresses.
- Sensitive configuration (like third-party storage credentials, when configured) is encrypted at rest.
- Report PINs are hashed, never stored in plain text.
- All traffic to the site is encrypted in transit (HTTPS).
Your rights
Depending on where you're located, you may have rights to access, correct, or delete the personal data we hold about you, or to object to certain processing. To exercise any of these, email us — see "Contact us" below — and we'll respond within a reasonable time. If you'd like a specific report deleted early, tell us the report URL or token and we'll remove it.
Children's privacy
FixBrokenApp is a professional software service and is not directed at, or knowingly used to collect data from, children under 16.
Changes to this policy
If we materially change how we handle your data, we'll update this page and change the "Last updated" date at the top. Continued use of the site after a change means you accept the updated policy.
Contact us
Questions about this policy or your data — reach us at rehman.infinitech@gmail.com or via WhatsApp.