Privacy Policy

Routelint (“we”, “us”, or “our”) provides tools that record APIs a running web application already calls, replay those calls across identities, and score how a public site reads to search and answer engines.

We do not currently publish a support email. Privacy Policy, Terms of Use, and product docs on this site are the source of truth. When a contact channel is listed on the About page, use that for privacy requests.

When you create an account we store the information you submit and technical records needed to keep the account secure.

• Email address (unique login identifier)
• Optional display name
• Password hash (bcrypt; we never store your password in plaintext)
• Organization / account record linked to your user
• Session cookie after you sign in (signed token; membership is rechecked on each request)
• Auth events: register, login success, login failure, and logout, with approximate IP and timestamp for abuse prevention

If you use the API scan product, we store the hosts and scan artifacts you create under your account.

• Target metadata: name, domain, base URL, environment, path scope, rate limits, and ownership verification status
• Ownership verification token used to prove you control the host
• Identities you configure for replay (labels, auth method, login selectors). Credentials are encrypted at rest with an application master key
• Captured calls: method, URL pattern, query keys, and redacted request/response bodies
• Routes discovered from crawl or probes
• Scan jobs: status, timing, error messages, and aggregate stats
• Findings: severity, title, description, category, suite, HTTP status, and redacted evidence
• Suppressions, audit log entries for scan traffic, and scan observation fingerprints used for diffs

Before captured traffic or findings are stored, Routelint attempts to strip common secrets and personal data from evidence, including emails, phone numbers, payment card patterns, JWTs/tokens, and password hashes. Redaction reduces risk; it is not a guarantee that every sensitive string is removed. Do not paste production secrets into fields that are not designed for encrypted credential storage.

You can run limited scans or SEO checks without signing in. For those flows we store temporary trial records and share links so the work can be claimed or reopened later.

• Guest cookie and hashed identifiers (including hashed IP and device fingerprint hashes) used to enforce daily free-scan limits
• Guest organization and target records until you register and claim them, or they are cleaned up
• SEO/GEO share records: URL scanned, report JSON, optional organization link, and a hashed unlock token for evidence

If you purchase a plan, payment is processed by Razorpay. We store order and payment identifiers, amount, currency, seat quantity, coupon code if used, payment status, and the paid access period. Card numbers are handled by Razorpay; we do not store full card data on Routelint servers.

When Google Analytics is enabled for the site, Google may collect device, browser, approximate location, and page-view data via cookies and similar technologies under Google’s terms. We use this to understand product usage. You can block analytics cookies in your browser. Analytics is loaded only when a measurement ID is configured for the deployment.

We also use Redis-backed rate limits keyed by IP (and sometimes email) to slow abuse of login, register, and scan endpoints. Those counters are short-lived operational data.

Routelint uses cookies and similar storage that are needed to run the product or to measure usage when analytics is enabled.

• Session cookie — keeps you signed in after login (signed token; membership is rechecked on the server)
• Guest cookie (routelint_guest) — ties a free trial browser to a temporary organization so scan limits and claim-on-signup can work
• Google Analytics cookies — only when a measurement ID is configured; used for page views and product analytics under Google’s terms
• Browser local storage may be used by the front end for short-lived UI state; it is not used as a substitute for account authentication

We use the data above to:

• Provide, secure, and improve the Routelint product
• Authenticate you and protect accounts against abuse
• Run scans you request against hosts you verify
• Show dashboards, findings, and SEO/GEO results
• Process payments and enforce plan limits
• Comply with law and respond to lawful requests

We do not sell your personal information. We use infrastructure providers that process data on our behalf to run the product, for example cloud hosting (such as Vercel), managed Postgres (such as Supabase), managed Redis (such as Upstash), payment processing (Razorpay), and analytics (Google Analytics when enabled).

We may disclose information if required by law, to protect rights and safety, or in connection with a merger, acquisition, or asset sale, subject to appropriate safeguards.

Account and product data are kept while your account is active and as needed to provide the service. Auth events and rate-limit data are kept for security and abuse prevention. Guest trial data may be deleted or merged when you claim a trial or after inactivity. When a contact channel is listed on the About page, you may use it to request deletion of account data. Some records may be retained where we have a legal or security obligation.

We use HTTPS, hashed passwords, signed session cookies, encrypted identity credentials at rest, host ownership checks before active scans, and redaction of common secrets in stored evidence. No method of transmission or storage is completely secure.

Depending on where you live, you may have rights to access, correct, export, or delete personal data, or to object to certain processing. Use the Contact section on the About page when a channel is listed there. You can close your session with logout. You can refuse analytics cookies via browser settings. Do not use the product if you do not agree with this policy.

Routelint is directed at adults and professional teams. We do not knowingly collect personal information from children under 16.

We may update this Privacy Policy. The effective date at the top of the page will change when we do. Continued use of the service after an update means you accept the revised policy, except where local law requires additional consent.