Privacy
Privacy policy
NextPlay Solutions · October 15, 2026
Who we are
Burnproof is operated by NextPlay Solutions. This policy covers the site at burnproof.dev. Questions about your data: privacy@burnproof.dev.
What a scan stores
When you scan a URL, we store the report: the URL, the time, the score, masked findings, and short notes. We do not store the raw page, the raw scripts, database rows, or the full secret values. A share link can also carry a compressed copy of that same report in the URL hash, which your browser holds.
If you join the waitlist, we store the email address and the plan you asked about (Launch Check, Monitor, or Agency). If you pay later, we store the email the payment provider sends us, the plan, and a provider reference so we can tell a new purchase from a cancellation. We do not ask for a password, and the access page is not an account.
Monitor and Agency
If Monitor or Agency is active, we store the app URLs you save (up to 3 on Monitor, up to 10 on Agency) and each weekly re-scan: the report, which masked findings are new since the last scan, and whether an alert was sent, logged, or still waiting. The first scan of a URL is a baseline. After the weekly rescan, new findings are emailed to the checkout address from alerts@burnproof.dev. The message contains the app URL, the new masked findings, and a report link. It does not contain raw secrets. The report page still says Burnproof.
Payments
Card numbers are handled by the payment provider you check out with (Polar, Lemon Squeezy, or Stripe). Burnproof receives a webhook that a purchase happened. We do not receive your card number.
Ownership checks
A verification token is stored with the URL you entered and an expiry of about 30 minutes. After it expires, it is no longer accepted. The token is a random string, not a password to your app.
Rate limits and logs
We use the requesting IP address, from the hosting platform's forwarded headers, to limit how often a network can scan. Those counters live in memory on the server instance and are not a long-term profile. Hosting logs may include the URL path and status code.
Cookies
Burnproof does not set a tracking cookie and does not run an advertising pixel. The report page uses session storage in your browser so a result can reopen if the server copy is missing.
Sharing
We do not sell personal information. We share it with the infrastructure that runs the site (hosting and, when configured, the database, the payment provider, and Resend for alert email) and if the law requires it. Report links are unlisted. Anyone with the link can read the masked findings.
Retention and requests
Reports, waitlist emails, plan records, saved app URLs, and weekly monitor results stay until we delete them or you ask us to. Email privacy@burnproof.dev to ask for a copy or deletion of the email and plan records we hold for you. Reports that were shared by link may already have been copied.