Privacy policy

What we collect, and why

CSP violation reports. When a customer points an app's Content Security Policy reporting directive at Offscript, browsers that load the app send us violation reports. For each report we store the raw report, its content type, the IP address of the browser that sent it, and when we received it. We also store any detections that come out of analyzing it, including the address of the page it came from, without its query string. We deliberately don't store the request headers of reporting browsers.

Account data. Clerk, our authentication provider, handles sign-in. We keep the organization name, the signed-in member's email address, the organization identifiers we need to keep each customer's data separate, and any notification email addresses an admin sets up. We only use those addresses to send detection alerts, through Resend, our email provider.

Contact messages. What you send through our contact form (name, email address, message) is only used to answer you.

What we never collect

We only receive CSP violation reports from our customers' own apps. A report is basically the address of a script or connection the policy didn't allow. We never see browsing history, page contents, form data or keystrokes, or anything about what people do on other sites. Offscript is not an employee-monitoring tool, and we don't sell or rent any data we process.

Retention

Raw CSP violation reports and their IP addresses are deleted automatically after 30 days. Detection records keep the IP address of each browser that reported the malicious URL, so customers can find the affected devices. By default those IP addresses are kept for as long as the account exists. Each customer can have them deleted after a set number of days, or as soon as the alert is sent; if that comes before the 30 days, the customer's raw reports are deleted then too. The detection itself stays, without the IP addresses, so your dashboard history stays useful. To avoid alerting twice about the same device, we keep a keyed hash of its IP address for 24 hours, then delete it. Account data is kept for as long as the account exists. We keep nightly database backups for 15 days, so anything deleted above, IP addresses included, can stay in a backup for up to 15 more days.

Where data lives, and who processes it

Report data is stored in a managed Postgres database on Supabase, in the us-east-1 region. It reaches us over HTTPS and is encrypted at rest. Nightly backups of that database are stored encrypted in Google Cloud Storage, in the us-central1 region.

We use these subprocessors to run the service: Clerk (authentication), Supabase (database), Vercel (website hosting), Google Cloud (report intake and analysis), and Resend (alert emails).

To decide whether a URL from a report is malicious, we send that URL to threat-intelligence providers. We never send who you are or who reported it.

Your choices and how to reach us

You decide which apps report to Offscript, and you can stop at any time by removing our URL from your Content Security Policy. To ask what data we hold, request deletion, or ask any privacy question, use the contact page. We usually reply within one business day.