Your check files are kept for 30 days and deleted automatically. Results (scores, findings with masked evidence, model answers) stay at the secret link.
Scripts from skills are never executed. Keys and tokens found are never tested for validity and are masked in reports.
A full check sends the SKILL.md text and your cases to the model providers (see Pricing → models).
We store your email (for sign-in), a hash of your IP address (for limits) and a session cookie. No passwords.
Skills added to the rating are public, like their source catalogs.