How Pipegrade handles data

Last updated: May 7, 2026

What we collect

Workflow YAML you paste into the anonymous scanner.
Redacted scan results, findings, scores, structural metadata, and report IDs.
Email addresses submitted through update, pricing, template, or audit forms.
Cookie-less, aggregated page-view analytics from Vercel Web Analytics.
Optional product analytics events if analytics consent is granted.

Workflow scan handling

Secret redaction runs before storage. Raw pre-redaction YAML is processed in memory during the scan request and is not intentionally stored by Pipegrade. Anonymous reports retain redacted, scope-aware excerpts around findings, a structural skeleton, scan scores, findings, and a SHA-256 hash of the redacted input.

Anonymous scan reports are unlisted by UUID, noindexed by page metadata and HTTP headers, and expire after 14 days. Report pages include a delete link token when the scan is created.

How we use data

Generate and display workflow grades, findings, badges, and shareable reports.
Send requested product updates, pricing notifications, or audit follow-up.
Understand aggregate traffic patterns with privacy-focused Web Analytics.
Improve rule quality and product reliability using consented product events.

Retention

Anonymous scans are retained for 14 days unless deleted earlier with the delete token, then physically removed by cleanup. Email leads are retained until they are no longer needed for product communication, customer support, or legal obligations.

Anonymous scan storage is best-effort. Free public scans do not carry a backup or restore SLA; users can re-paste a workflow to generate a fresh report.

Third parties

Pipegrade uses Resend for email delivery and Vercel Web Analytics for aggregated, cookie-less traffic analytics. Anonymous scan report pages are excluded from Vercel Web Analytics so unlisted report URLs are not sent as page-view paths. Optional product analytics events remain behind the consent control. Paid purchases are not currently available. Pipegrade does not sell personal information.

Cookies and analytics consent

Vercel Web Analytics does not use cookies. If Pipegrade presents optional product-event analytics controls, the consent cookie stores that preference and those optional events are skipped unless you choose to allow analytics. See the Cookie Policy for details.

Your choices

You can delete anonymous scans with the scan delete link, opt out of product emails, or request access, correction, or deletion of personal data by contacting Pipegrade.

Contact

Privacy requests can be sent to david@pipegrade.io.