Privacy Policy

Last updated: 7 October 2026

Kevick checks websites you submit and tells you what it found. This page says what we keep, why, and what happens when you leave.

What we keep

• Your account: your email address and your password. Our sign-in provider stores the password in a form we cannot read.
• The sites you check: the web address you submit, and the address it led to.
• Your reports: for each check, the verdict, the result for each area we examined, and each finding, including a short description of what we observed.
• An ownership code for each site you check. You can publish it on your own site to prove you own it.
• Run records: when each check ran, how long it took, and the site's host name. We use them to prevent abuse and to understand what running Kevick costs.
• Your answer about checking code: if you tell us you would want Kevick to check your code, we keep that answer with your account. We use it to count how many people want this, and to email you once, at the address you signed up with, if we build it, and not otherwise. Deleting your account deletes it. You can also remove it yourself at any time, from any of your reports.

What we do not keep

• The pages we read. Kevick reads the page you submit and, once you have proven you own the site, the scripts it links on the same site, then discards them. When you check a site again, it also reads one small file there, /.well-known/kevick-verify.txt, to see whether you have published your ownership code. It never stores them and never runs them.
• Payment details. Kevick is free and takes no payments.
• Files. Kevick does not accept uploads.

Who helps us run Kevick

• Supabase stores our database and handles sign-in. It keeps that data in the EU (Frankfurt).
• Resend sends Kevick's emails, such as confirmation and sign-in links. To do that it receives your email address and every email we send you, including those links. Resend sends from Ireland, but keeps the emails it sends and records about them, such as the address each went to, in the United States for 30 days.
• Vercel hosts the website. Like any web host, it logs requests, including IP addresses.
• Cloudflare Turnstile checks that requests from the sign-in and password-reset forms come from a person, using information from your browser.

We do not send your data to any AI service. We do not sell your data. We use no advertising or analytics cookies, only the cookies that keep you signed in.

Why we use it

To provide the service you signed up for: running the checks you ask for and showing you the results.

Deleting your data, or getting a copy

Email hello@kevick.com. Deleting your account removes your account, your sites, your reports and your findings. Two kinds of record remain: run records, which keep the site's host name and an internal number that no longer matches any account; and our security log, which keeps what ran and when, with no account attached.

Contact

Questions about your data: hello@kevick.com. Security issues: security@kevick.com.