Privacy policy
This policy describes the personal data Fulcrum collects, why it is collected, how long it is kept, and what you can ask us to do with it. It is written against the Digital Personal Data Protection Act, 2023 of India (the “DPDP Act”), under which Aaryan G is the Data Fiduciary and you are a Data Principal.
It describes the service as it is actually built. Where a limitation is awkward, it is stated rather than omitted.
Who operates this service
Fulcrum is operated by Aaryan G, an individual, not a registered company. For any question, complaint or request about your personal data, including erasure, contact the Grievance Officer at aaryan@fulcrumsecurity.in.
You must be 18 or older
Accounts are only for people aged 18 or over. You confirm your age when you register, and we record that you did so and when. We do not ask for your date of birth, because confirming the threshold is all that is needed and collecting the exact date would be more data than the purpose requires.
Under the DPDP Act anyone under 18 is a child, and processing a child’s data requires verifiable parental consent. Fulcrum is not built to obtain that, which is why the threshold is 18 rather than lower. If you believe someone under 18 has created an account, write to the Grievance Officer and it will be deleted.
What we collect, and why
Information you give us
| Data | Why |
|---|---|
| Email address | Identifies your account, is how you sign in, and labels the entry in your authenticator app. We also send a small number of messages to it, described under Email below — never marketing. |
| Password | Stored only as an argon2id hash, never in a form that can be reversed back to your password. We cannot read it, and neither can anyone who obtains the database. |
| Two-factor secret and backup codes | Required on every account. The secret is encrypted at rest with AES-256-GCM; backup codes are stored hashed, like passwords. |
| Age and terms confirmation | The fact that you confirmed you are 18 or over and accepted the Terms, and when. A consent record is only meaningful if it is timestamped. |
| Hostnames you register | To check you control a domain before scanning it, and to list your domains back to you. |
| Whether and when you confirmed your email address | Nothing can sign in until the address has been confirmed, so we know the person registering can read mail sent to it. |
| Scan schedules you set | Which domain, how often, and whether you want an email if the result gets worse — so the scans run and you are told. |
| Share links you create | When each was made, when it expires and whether it was revoked. The link itself is not stored — only a one-way hash of it — so it cannot be recovered, only replaced. |
Information created by using the service
| Data | Why |
|---|---|
| Scan results | The findings, score, grade and remediation plan for each scan, and the hostname scanned. These are your results and are shown only to you. |
| Sign-in activity | Each sign-in attempt — successful or not — with the time and outcome. Used to lock an account under attack, to rate limit, and to show you your own recent activity on the account page. |
| Security audit records | Sign-ins, failed sign-ins, rejected requests, rate-limit trips, domain changes, scans and administrator actions, recorded against your email address. This is the record that makes it possible to tell what happened if an account is compromised. |
| Session records | A hash of each session token, so a stolen session can be detected and every session in that family revoked at once. |
| Browser user-agent string | Recorded with sign-ins and sessions, to help you recognise activity that was not you. |
One-time links we email you
To confirm your address and to reset a password, we generate a random single-use link and email it to you. We store only a one-way hash of it and its expiry time, never the link, so reading our database does not yield a working link. It is deleted shortly after it expires or is used.
IP addresses — only in some deployments
Whether your IP address is recorded depends on how this instance is configured. Fulcrum only accepts a client IP when it is deployed behind a reverse proxy it has been explicitly told to trust, and that setting is off by default. When it is off, no IP address is stored against your sign-ins, sessions or audit records at all.
When it is on, IP addresses are recorded alongside sign-in attempts, sessions and audit records, for the same reasons: detecting attacks and letting you recognise activity that was not you. Separately, whatever reverse proxy or hosting provider sits in front of this service keeps its own access logs, which are outside this application.
Scans run in the background, after your request has finished, so the audit record written when a scan completes or fails names your account but carries no IP address or browser details. Those are recorded once, on the entry made when you asked for the scan.
The check on the home page
You can check a site’s headers from the home page without an account. Nothing about that check is stored for you: there is no result to look up later. The security audit log records that a check of that hostname was requested and its grade, and your IP address where this deployment collects one (see below), for the reasons given there — chiefly so the feature cannot be used to send traffic at someone else without anyone being able to tell who.
Data about the sites you scan
A scan records what the target host sent back: response headers, any software version it advertises, cookie names (never cookie values), and TLS and certificate facts. Where the site you scan belongs to someone else, that content is stored in your scan result. All of it is truncated and sanitised before storage, and it is never treated as instructions — only as data to display.
What we do not do
These are verifiable by reading the source, not just promises:
- No analytics, advertising or tracking of any kind. There is no analytics provider, tag manager, advertising SDK, session recorder, heat-mapping tool or error-reporting service in this application. Not configured off — not present.
- No third-party code runs in your browser. No external scripts, no embedded frames, no third-party fonts. The Content Security Policy this site sends would block them if any were added.
- No profiling and no automated decisions about you. Fulcrum grades websites, not people.
- We never sell or share your personal data, and there are no advertising or data-broker relationships to disclose.
Who else receives your data
Your email address is handled by one service: the one that delivers our email. That is Brevo, a transactional email service that sends our messages on our behalf. It sees the address and the content of each message we send you, and nothing else about you. Fulcrum sends no data to any analytics endpoint, advertising network or other processor.
Apart from that, the only outbound network activity is caused by you, and consists of:
- DNS lookups for hostnames you submit — which necessarily disclose that hostname to DNS infrastructure.
- Connections to the hostname you asked us to check — which disclose this server’s IP address and a Fulcrum user-agent string to that host. Your identity is not sent.
The infrastructure this service runs on — the hosting provider and the database it runs against — necessarily processes data on our behalf.
Fulcrum sends email for exactly four reasons, and no others. There is no marketing list, no newsletter and no tracking: the messages contain no images, no tracking pixels and no wrapped links.
- To confirm your address when you register.
- To reset a password, when you ask us to.
- To tell you your password was changed, so a change you did not make does not go unnoticed.
- Alerts you turned on yourself: if you schedule scans of a domain and choose to be told when the result gets worse, we email you when it does, and if a schedule is paused because ownership of the domain is no longer verified. You can turn these off at any time from your dashboard.
Because none of these is marketing, they are sent whether or not you have opted into anything else, and the first three cannot be switched off. There is no unsubscribe link on them for that reason; the alerts you chose have a switch in your dashboard instead.
If you lose access
Resetting a password by email also needs a code from your authenticator app or one of your backup codes. This is deliberate: access to an inbox alone must not be enough to take over an account on a security tool, or two-factor authentication would protect nothing. The consequence is that if you lose your authenticator and every backup code, we cannot restore access — we hold nothing that would let us tell it is really you. Keep your backup codes somewhere other than your phone.
How long we keep it
| Data | Kept for |
|---|---|
| Account, domains, scan results, sign-in history | Until you delete your account, then removed. |
| Expired session records | Removed automatically once expired. |
| One-time email links (as hashes) | Removed automatically a week after they expire or are used. |
| Share links and scan schedules | Until you revoke or remove them or delete the account. Share links also stop working at their expiry, 30 days after they are made. |
| Security audit records | 180 days, then destroyed — including after you delete your account. See below. |
Why audit records outlive your account
The security audit log is append-only: the database itself refuses to let this application modify or delete a row in it. That is deliberate. A log an attacker can edit after the fact records nothing worth having, and the entries that matter most are usually the ones concerning an account that was later removed.
The consequence is honest and worth stating plainly: after you delete your account, audit entries naming your email address, and your IP address where one was collected, remain for up to 180 days. They are then destroyed automatically when the storage holding them is dropped. Nothing is kept beyond that window, and no person has to remember to delete it.
Your rights
Under the DPDP Act you may, at any time:
- Ask what we hold about you. Your account page shows your details, domains, scans and recent sign-in activity. You can also download everything in machine-readable form.
- Correct or complete it. Write to the Grievance Officer.
- Erase it. Delete your account from the account page. This removes your account, domains, scan results, sessions and sign-in history immediately, subject to the audit-record window above. It cannot be undone.
- Complain. Write to the Grievance Officer, who will respond. You may also complain to the Data Protection Board of India.
- Nominate someone to exercise these rights on your behalf in the event of your death or incapacity. Contact the Grievance Officer.
How your data is protected
- Two-factor authentication is required on every account.
- Passwords and backup codes are stored as argon2id hashes; two-factor secrets are encrypted at rest.
- Sessions use short-lived tokens that rotate, and re-use of a rotated token revokes the entire session family.
- The security audit log cannot be altered by the application.
- Administrators must re-enter their password and a two-factor code before any action affecting another account, and every such action is logged.
No service can promise it will not be breached, and this one does not. If a breach affects your personal data, we will notify you and the Data Protection Board as required.
Cookies
Fulcrum sets five cookies that are strictly necessary to sign you in and keep the session safe, and one more, fulcrum_theme, only if you press the light/dark switch, to remember your choice. There are no analytics or advertising cookies, which is why you are not asked to consent to any. The cookie policy lists each one, what it does and how long it lasts.
Changes to this policy
If this policy changes materially, the date at the foot of the page changes and signed-in users are told. Continuing to use the service after a change means the new version applies.