Norveth

Privacy Policy

Last updated: July 23, 2026

This Privacy Policy explains what Norveth collects when you visit the site or use the platform to scan a website, how that information is used, and who it's shared with.

1. Information we collect

  • Account information: name, email address, a bcrypt hash of your password (or your OAuth/passkey identity — we never see or store the password itself for those), and organization details.
  • Scan input: the URLs you submit for analysis.
  • Scan output: the report Norveth generates — screenshots, rendered page content, HTTP headers, and the findings and scores derived from them.
  • Usage data: basic product telemetry (pages visited in the dashboard, API calls made) used to operate and debug the service. Norveth does not currently run third-party analytics or ad-tracking scripts.

2. How we use it

  • Generating your analysis report and powering the AI chat for that project.
  • Authenticating your access and securing your account.
  • Responding to support requests.
  • Enforcing plan quotas and rate limits, and preventing abuse of the scanning infrastructure.

The URL you submit and the resulting report are not used to train any AI model, foundational or otherwise.

3. What Norveth does not do

Norveth analyzes public websites, not private source code repositories. It does not request GitHub/GitLab OAuth scopes to read your code, and it does not store commit history or source trees. The one exception: where a website's own client-side bundle is fetched as part of rendering the page (for source-map reconstruction of that public-facing JavaScript), that data is treated the same as any other scan output above.

4. Third-party processors

Norveth runs on a small set of infrastructure providers, each processing only what's needed to provide the service:

  • PostgreSQL — primary database (accounts, projects, reports).
  • Vercel — application hosting for the web app and analysis service.
  • Upstash — rate-limiting and caching.
  • Resend — transactional email (verification codes, notifications).
  • Cloudflare — DNS and Turnstile bot protection on signup/login.
  • Google (Gemini) — AI reasoning over your scan results, to generate report summaries and power chat.

5. Security

All traffic runs over TLS. Passwords are hashed with bcrypt before storage — Norveth never stores or logs a plaintext password. Sessions are revocable, and API requests are authenticated with per-key tokens that are hashed at rest. Norveth is independently operated and has not undergone a third-party security certification (SOC 2 or similar) — see the Trust Center for the specific controls that are in place today.

6. Your data rights

You can delete a project from your dashboard to remove its scan results and reports from Norveth's active database. For a full account deletion, or any access/correction/portability request, email privacy@norveth.app.

Questions about this policy: privacy@norveth.app.