RedMirror, Privacy Policy

Last updated: July 2026

RedMirror is operated by Dodo Network Ltd, a company domiciled in Mauritius (“we”, “us”). This policy explains what personal data we collect, why, how long we keep it, and your choices. It is written in plain language and is a starting point, not legal advice.

What we collect

• Account: your email address, an optional name, and — if you sign in with a wallet — your public wallet address.
• Payments: when you top up with PayPal we receive the payment confirmation from PayPal (payer email, amount, order id). When you pay with crypto we record your wallet address and the on-chain transaction hash. We never see or store your card numbers or private keys.
• Usage & billing: per-request token counts and cost, used to meter your balance, and a log of high-level actions you take (for example “scan” or “top up”). This action log does not include your prompts or your code.
• Scan content: to run a scan we process the source code you submit, or the public GitHub repository you choose. See “How scans handle your code” below.
• Technical: your IP address and basic request metadata, handled by our security provider (Cloudflare) to protect the service from abuse, and a human-verification check (Cloudflare Turnstile) at sign-up.

How scans handle your code

When you scan a repository, the in-scope source is analysed to produce findings. Two things you should know:

• Producing findings involves sending the relevant source to a third-party AI model provider that our engine uses. That provider processes the code to generate results and does not receive your identity.
• The source you upload (or the public repository we fetch) is deleted from our servers after the scan finishes. The resulting report is kept in your account so you can re-open it later. A report may quote short excerpts of the scanned code. You can delete any report yourself at any time from your dashboard, and it is removed from our servers.

Cookies & browser storage

We use Google Analytics to understand how the site is used (for example, which pages people visit). It sets analytics cookies such as _ga — but only after you accept them. Analytics storage defaults to denied (Google Consent Mode v2), and a banner asks for your choice on your first visit; if you decline, no analytics cookies are set. You can revisit the choice by clearing the rm_consent value in your browser storage. We do not use advertising cookies and do not sell your data.

Separately, we store a small amount of data in your browser strictly to run the service: a sign-in token and your scan labels (in local storage), and a temporary value during a PayPal redirect. Our security providers also set cookies — Cloudflare (bot protection) and Turnstile (the human check); these are strictly necessary and do not require consent.

Who we share data with

We use a small number of processors to run the service, and we do not sell your personal data:

• Cloudflare, Inc. — content delivery, the isolated scan sandbox, security (WAF, Turnstile) and email delivery.
• Google LLC (Google Analytics) — site-usage analytics, only after you accept analytics cookies.
• PayPal — PayPal payments.
• The crypto payment facilitator and the public blockchain (Base) — crypto payments; on-chain transactions are public by nature.
• Our AI model provider(s) — receive scan content to produce findings, as described above.

We may also disclose data where required by law.

Where your data is stored

Your account, billing and report data are stored on servers located in the European Union (Germany). Some processing (content delivery, the scan sandbox, payments, AI analysis) happens through the global providers listed above, which may process data in other countries.

How long we keep it

• Uploaded source code: deleted immediately after each scan.
• Reports: kept until you delete them, or until your account is closed. We do not auto-delete them.
• Account & billing records: kept while your account is open and for as long as needed for accounting and legal purposes.

Your rights

Depending on where you live (for example under the EU/UK GDPR or California’s CCPA/CPRA), you may have the right to access, correct, delete, export or object to the processing of your personal data. You can delete individual reports yourself from your dashboard. To access or delete your account and associated data, email us at [email protected]. We do not sell personal data.

Security

We use encryption in transit (TLS) and keep the credentials that matter (payment and model keys) on our servers, never in your browser. No method of storage or transmission is perfectly secure, and the service is provided “as is” — see our Terms.

Children

RedMirror is not directed to children and is intended for users aged 18 or over.

Changes

We may update this policy; we will change the date above when we do. Continued use after a change means you accept the updated policy.

Contact

Questions or requests: [email protected].

This is a plain-language summary of how we handle data and is a starting point, not legal advice. We recommend your own legal review before relying on it.