Privacy Notice

Last updated: 2026-10-18

LockdownLaunch is operated by Aervo LLC. This notice explains what Aervo LLC (“LockdownLaunch,” “we”) collects when you use lockdownlaunch.com, why we collect it, and how long we keep it.

What we collect, why, and how long we keep it

Waitlist: your email, the app URL if you give one, the date, and a one-way hash of your IP address (used to block spam). We use this to tell you when paid reports open. It is kept until you ask us to remove it.
Free scans: the scanned domain, its grade, and counts of findings, so we can understand usage and improve the scanner. We don’t store your email for free scans. This is deleted automatically after 90 days.
Ownership verification: your email, the app URL, the verification token, and the method you used. Unfinished checks are deleted after 24 hours. Paid orders are kept for 30 days.
Paid orders and reports: your email, the app URL, the report contents, the Stripe session ID, and the payment and delivery times. We use these to produce and email your report and to provide support. Reports and order records are deleted from our systems 30 days after the order. Anyone with your private report link can view it until then, so don’t share the link.
Launch-ready certificates: if your app earns one, a public verification page shows the app URL, grade, finding counts, and issue and expiry dates. It does not show your email. This record is kept for up to 12 months.
Payments: Stripe handles payments. We receive payment status and basic customer details from Stripe. We never receive full card numbers. Stripe keeps payment records as its own policies and the law require.
Abuse prevention: we keep short-lived, hashed IP records to enforce rate limits. They expire within hours. Our hosting provider, Cloudflare, may process IP addresses and request logs to deliver and secure the site.
Support email: if you email us, we keep the conversation to help you and only as long as needed for that purpose.

What we don’t do

We don’t store the contents of your database. Our deep checks record table names, row counts, and yes/no exposure results only. The data itself is discarded.
We don’t use any keys we find in your app against third-party services.
We don’t sell or rent your personal data, and we don’t use it for advertising.
We don’t ask for, or access, your source code.

Service providers (subprocessors)

Cloudflare for website hosting, DNS, data storage, and email forwarding.
Stripe for payments.
Resend for sending report emails.
Google (Gmail) for receiving support email.

These providers may process data in the United States and other countries.

Cookies and browser storage

We use no advertising or analytics cookies. We use only these strictly necessary items:

ll_sid: a session cookie that links your ownership check to your browser. It expires after 24 hours.
ll_preview: used only for invited preview access before public launch. It expires after 7 days.
ll_challenge (browser session storage, not a cookie): remembers your verification step until you close the tab. It is never sent to us automatically.

Your choices and rights

To access, correct, or delete your data, or to leave the waitlist, email [email protected] from the address involved. We will respond within 30 days. Depending on where you live (for example the EU, UK, or California), you may have more rights, including the right to complain to your local data protection authority.

Children

LockdownLaunch is not for children under 13, or under 16 in the EU and UK. We don’t knowingly collect their data. If you think a child has given us data, contact us and we will delete it.

Changes

If we change this notice, we will update the date above. If the changes are material, we will tell customers by email where reasonable.

Contact

LockdownLaunch is operated by Aervo LLC. Contact: [email protected]