Privacy & your data

What stays with you, and what we receive.

Product by product: what never leaves your phone, browser or website, what reaches us and why, how long we keep it and who helps us process it.

AI privacy

Privacy keyboard, “check before sharing”, browser extension and the AI privacy check

Never leaves your device or site

Anything you type with the privacy keyboard. It checks text on the phone, never stores, logs or sends it, and does not read password fields.
Text you check or share into the app. On iPhone, text shared from another app waits in the app’s private storage until you next open the app, then is deleted.
What you type or paste into ChatGPT, Claude or Gemini with the browser extension, and the values it hides. The extension makes no network requests.
Which placeholder stands for which value. The extension keeps this in browser memory, cleared when you close the browser, so replies can show the real values on your screen.
Text you paste into the AI privacy check on this website. It is checked in your browser; the page sends it nowhere.
Passwords you check for leaks. Only the first 5 characters of the password’s SHA-1 fingerprint go to Have I Been Pwned; the comparison happens on the phone.

What we receive (and why)

Counts from the phone app, at most once an hour
For example “3 email addresses hidden, 1 warning, 2 sites blocked, 4 checks”. Never the text, the values found or the sites. They show you (or your company’s administrators, if your company manages the phone) that the protection is working.
Nothing from the browser extension
Its settings and daily counts stay in your browser, for the last 60 days, and are deleted when you remove it.
Nothing from the AI privacy check
The page loads like any other page; what you paste is not part of any request.

What the AI service receives: your message with placeholders instead of the items found. Detection is automatic and cannot find everything (names and street addresses, for example), so read what you send. If you choose to send the original, or turn a type off, the AI service receives your text as you wrote it.

WordPress

WordPress plugin and the dashboard

Never leaves your device or site

The personal data the AI privacy filter hides. Detection and masking run on your own server, inside WordPress. The values are put back into the AI’s reply on your server, and the list of placeholders lives in memory for that one request only. The values are never stored or logged.
The prompts, replies and API keys of your site’s AI calls. AI usage reports keep counts, models and token numbers only.
Your posts, pages, orders and customer records, and your files (a finding carries only a short excerpt of the code it flagged).
WordPress passwords and user IDs. The site always starts the connection; the dashboard never signs in to your site and never stores WordPress credentials.

What we receive (and why)

Site status
Security score, open issues, protection and backup status, WordPress, PHP and plugin versions, known vulnerable plugins, and the settings the dashboard can show (never credentials). This is what the dashboard displays.
Security events
Medium severity and above, such as blocked attacks and sign-in lockouts. They can include usernames and the IP addresses of people signing in to your site; IP addresses are shortened by default, and your account can choose full or none. Used for alerts and the activity log.
File scan findings
The file path, what matched, the line, a short excerpt of the matched code (at most 300 characters) and the file’s fingerprint. Keys found in code are sent masked. So you can review and clean up from the dashboard.
AI privacy and AI usage counts
How many items of each type the filter hid per day, and which plugin called which AI service, with the model, token counts and an estimated cost. Numbers only, for your reports.
Business details for your privacy policy
Only if you fill them in: the legal name, address and privacy contact your site’s policy publishes.

The filter never blocks your site’s AI features: if a request cannot be read or is very large, it goes out unchanged and is counted as such. Streamed replies keep their placeholders.

Family

Cyber Securitise Family app

Never leaves your device or site

Messages, typed text, notification contents and files, on a parent’s or a child’s phone.
Browsing history. The site filter runs on the phone and sees only website names; blocked names are stopped there and are not reported, only counted by category.
What the kids keyboard warns about. It warns the child before they share their phone number, email or ID numbers, and never masks or blocks silently; only counts reach the parent’s weekly report.

What we receive (and why)

Your account
The parent’s email address (for the sign-in code), the children’s names and birth years you enter, and the rules you set. To run the family and its subscription.
From a child’s phone
The list of installed apps, daily minutes per app and screen time, location only when a parent turns it on, events such as an SOS, a new app, a removal attempt or a request for more time, security scan results, and counts of blocked sites by category. Parents see exactly this in the app.
From a parent’s phone
Only its own security scan results.

Website

This website

Never leaves your device or site

Anything you paste into the AI privacy check.
Analytics or advertising trackers: the site loads none.

What we receive (and why)

Free website scan
The address you scan, the results, and your IP address to prevent abuse; your email address only if you ask for the report by email. A bot check protects the form.
Messages you send us
So we can answer them.

How long we keep it

Security events from your sites: 90 days by default; your account can choose 30 to 365 days.
Resolved findings, handled alerts and remote actions: 180 days.
Disconnected sites: deleted after 30 days. Closed accounts: deleted after a 30-day grace period.
Free scan reports: 30 days.
Family app alerts: 30 days. Daily app usage: 35 days. Sign-in codes: deleted once used or expired.
A child’s location: only the latest point, deleted when location is turned off.
Phone reports and chatbot test results: 30 days, then deleted. On the 1st of each month we email the account owner a reminder; to keep a copy, save or print the page.
On your own site, the plugin keeps its AI privacy and AI usage counts for about 400 days; in your browser, the extension keeps its counts for 60 days.

Who processes it for us

Stripe: Payments and invoices. We never see your card number. In-app subscriptions are paid through Apple or Google.
Resend: Sends our emails (sign-in codes, alerts, reports), so it handles your email address and the message.
An AI model, through OpenRouter: Only for three dashboard features: the summary of a free scan (the scanned address and its results), the clean-up assistant (for a finding you ask it about: the file path, what matched and the short code excerpt) and “Test my chatbot” (the test prompts and your chatbot’s answers, to grade them; the answers are stored with the run, with keys masked). Every request is set to use only providers that don’t store or train on your data. Nothing from the AI privacy features is ever sent to it.
Have I Been Pwned: The leaked-password check: the first 5 characters of a fingerprint, never the password.
Public DNS resolvers: The phone’s site filter passes website names it does not block to Cloudflare (1.1.1.1), or Google if that fails, as your phone would without the app.
Hosting: The dashboard and its database run on our own server in Japan (Tokyo), rented from Contabo. Backups stay encrypted.

The full list and legal details are in our Privacy Policy.

We don’t sell your data or use it to train AI

We use what we receive to provide the products described on this page. We don’t sell it, we don’t use it to train AI, and this website carries no advertising trackers. Our staff only see your account’s data when you ask us to clean up a site, and every time they do it’s recorded in your audit log. We never log in to your site remotely: we can only send the actions you’ve switched on, and your site emails you about each one.

Privacy questions

Write to [email protected]. You can ask to see, correct, export or delete the data we hold about you or a device.