Your data,
handled with care.
What we collect, what we never collect, and the controls you have.
What we collect
When you use cqwerty, we collect: the domain name you submit for scanning, your email address and a hashed password if you create an account (or your Google account email if you sign in with Google), your IP address for rate limiting and abuse prevention, and product analytics events described in the cookies section. cqwerty is free during its beta: we process no payments and collect no payment information today. If we launch the planned paid plan, payments will be handled by a dedicated payment processor and this policy will be updated before anything is charged.
How we use your data
We use your data to run the security scans you request, show and store your scan reports, keep your scan history and saved domains attached to your account, send the emails described below, enforce rate limits, and improve the service.
What we scan
cqwerty only analyses publicly available information about your domain, using around 35 passive checks. These cover DNS records, TLS certificates, HTTP security headers, email authentication (SPF, DKIM, DMARC), WHOIS registration data, spam blocklists, and publicly exposed paths. We do not access your servers, internal networks, or any private data, and we run no intrusive or breach-database checks.
Data storage
Scan results are stored on servers located in Australia. Scans attached to an account stay in your scan history so you can track changes over time. You can request deletion of your scans, your account, or an export of your data at any time by emailing support@cqwerty.com.
Third party services
We use Resend for transactional email delivery, Vercel for frontend hosting and aggregate site analytics, Cloudflare for edge networking and bot protection (Turnstile), PostHog (EU-hosted, served via our own domain) for product analytics, Microsoft Clarity for optional session insights (only with your consent, see cookies), and OpenAI and Anthropic models to write the plain-language explanations in your report from the scan output. Each service has its own privacy policy governing your data.
Cookies and analytics
We store an authentication token in your browser (local storage plus a mirror cookie) to keep you signed in. Basic cookieless product analytics run for everyone. The optional layer, a persistent analytics cookie and Microsoft Clarity session replay, only turns on per the consent banner: in the EU, EEA, and UK it stays off unless you explicitly accept, and you can change your choice at any time via the cookie preferences link in the footer. We use no advertising pixels.
Email communications
If you create an account we send transactional email: address verification, password reset, and email-change confirmations. Where monitoring is enabled for your account, we send weekly monitoring summary emails, and we may occasionally send important service updates. Every non-essential email contains an unsubscribe link that works without signing in.
Chrome extension
The cqwerty Chrome extension shows the security posture of each site you visit. When you click the icon or the toolbar badge updates, the extension sends only the hostname of the current tab (e.g. example.com, never the full URL, page content, form data, cookies, or any other tab data) to api.cqwerty.com to fetch its public security grade. The extension caches recent scan results locally for 24 hours, stores up to 6 recently scanned domains, and (if signed in) keeps a copy of your authentication token in chrome.storage. None of that local data leaves your browser. The extension does not read pages, does not track browsing history, and does not run on third party sites. Uninstall via chrome://extensions to clear everything.
Data security
We protect your data with TLS in transit, bcrypt for password hashing, and restricted database access. We hold no payment details of any kind: there is nothing to bill during the beta.
Your rights
You have the right to access the data we hold about you, request correction or deletion, withdraw consent for email communications and analytics, and export your scan history. Email support@cqwerty.com for any data request.
Changes
We may update this privacy policy from time to time. We notify registered users of material changes by email. Continued use of the service after changes constitutes acceptance.
Contact
For privacy questions or data requests, email support@cqwerty.com. cqwerty is operated from Australia.