Privacy Policy
Last updated: August 2026
This Privacy Policy explains what SecondWatch collects and how that information is used when you use our services.
Who this applies to
SecondWatch is intended for business use. It is not directed at children under 13, and we do not knowingly collect information from children under 13. If you have questions about this policy, contact your SecondWatch account administrator or support channel.
Information we collect
Account information includes your email address and password (handled by Supabase Auth), optional profile details such as name, phone number, and avatar, account preferences for notifications and email, and a subscription plan field on your profile. In-app payment processing is not active. Threat profiles and business context include profile name, company or organization, industry, technology stack details you provide (such as operating systems, browsers, email services, phones, vendors, products, technologies, and related filters), severity filters, update cadence, and per-profile email settings. Product data includes reports, briefings, tracked findings, posture history, related job metadata, and files stored in our storage buckets (such as profile pictures and report artifacts). Technical and usage data includes authentication session cookies required to keep you signed in, theme and similar preference storage in the browser, your cookie consent preference, login activity such as approximate location derived from IP lookup (ipwho.is), and optional browser analytics via PostHog when you accept analytics cookies.
How we use information
We use this information to create and secure your account, filter public cyber disclosure data against your threat profiles, generate briefings, reports, and related product features, send report and notification emails you configure, improve reliability and understand product usage when analytics consent is given, and operate, secure, and support the platform.
AI processing
Some features send profile and report context to AI providers so we can generate summaries, enrichment, and recommended actions. That processing runs through our Fly.io backend and may include customer-derived prompt text sent to Anthropic. Treat AI output as advisory and verify it before taking security or business actions.
Service providers and infrastructure
We rely on processors to run the product, including Supabase for authentication, Postgres database, and file storage; Fly.io for long-running backend jobs such as ingest, report generation, and email sending; Vercel for hosting the web application; Anthropic for AI model processing used in report and enrichment features; PostHog for optional browser analytics after consent; SMTP email delivery for report and notification messages; ipwho.is for approximate geo lookup associated with login activity; and Supabase Auth for authentication-related email delivery. We do not currently process payments inside the application. There is no active in-app payment provider integration.
Cookies and similar technologies
Necessary cookies and storage include authentication and session cookies so you can stay signed in, theme and similar UI preferences, and your cookie consent preference. Optional analytics cookies and storage are used by PostHog when you choose Accept on the cookie banner. You can accept or decline optional analytics cookies in the banner. Declining does not block sign-in or core product use. Necessary cookies are required for the app to function.
Sharing
We do not sell your personal information. We share data with the service providers listed above as needed to operate SecondWatch, and when required by law. Report emails are delivered to the recipients you configure on a threat profile.
Retention and security
We retain account and product data while your account is active and as needed to operate the service. We apply standard technical controls such as encryption in transit, access controls, and provider security features. No method of transmission or storage is perfectly secure.
Your choices and rights
You can update profile and preference information in Settings, change threat profile and email settings in the product, and accept or decline optional analytics cookies. You can delete your account from Settings, which removes associated account data through our delete-account process. You can request access to or a copy of your data by contacting your SecondWatch administrator or support channel.
Changes
We may update this Privacy Policy from time to time. Material updates will be reflected on this page with a revised date. Continued use after updates means you should review the latest version.