Privacy

Who is responsible

NestCipher is operated by GoSmartR Ltd, a company registered in England and Wales (company number 15407332), registered office: 18 Howard Road, Reigate, Surrey, RH2 7JE, United Kingdom. GoSmartR Ltd is the data controller for this site.

What the tools do with your input

The Email Analyzer sends your pasted email to OpenAI for analysis and returns the result; the Headers Scanner fetches the URL you enter once from our server; the OWASP LLM Top 10 explorer runs entirely in your browser. The Research Workbench processes its session content locally and makes no model API calls. Optional account backup stores encrypted saved-vault snapshots on Supabase; working drafts are not uploaded. Paste only content you are comfortable sending to the listed providers — redact anything you would not.

Private research sessions

Research starts in the current page's memory. You can explicitly save it to an encrypted local vault in this browser, unlocked with your passphrase. Titles and record contents are encrypted before storage. The passphrase is not saved or sent to a server. There is no autosave or automatic sync. Optional account backup uploads only saved encrypted records after you choose to back up. Account sign-in and recovery do not unlock a vault or recover its passphrase. Keep a private backup; clearing browser data, storage eviction or a forgotten passphrase can make saved records unavailable.

The workbench does not send research to analytics or BotID. Cloud backup is explicit and contains encrypted records, with a limit of 3 MiB per account snapshot. Private search runs in the unlocked browser. Encryption protects stored content; it does not protect an unlocked page from compromised site code or device access. Other scripts on this site's origin can access or delete encrypted storage. Locking clears the workbench's open record and key references, but does not guarantee erasure from device memory. Normal hosting request logs still apply to loading the page.

Experiment Markdown notes, JSON backups and report snapshots are unencrypted private downloads. An Email Analyzer or Headers Scanner result can be downloaded and attached to an attempt without running the tool again. Snapshots contain the returned report, which may quote sensitive material, and exclude the original email input. An encrypted cloud archive needs the original vault passphrase for restoration. Private exports remain available while a challenge is live and during its waiting period. Review their contents before moving or sharing files.

NestCipher's site policy keeps details of how a live challenge was broken private until 30 days after the challenge ends. This is a project policy based on a rule provided by the owner; NestCipher has not independently verified it as an organiser's official rule. Check the terms of each challenge. This release provides no public sharing or submission capability, including after the waiting period.

Processors

SupabaseOptional research account and encrypted backup

Your account email, authentication and request information, and encrypted saved-vault snapshots when you explicitly back up. Snapshot identifiers, size, record count and upload time are visible; titles, research contents and disclosure notes are encrypted. Your vault passphrase is never sent.

VercelHosting and edge network

Standard request data (IP address, user agent) in transient infrastructure logs.

OpenAIEmail Analyzer model

The email content you paste into the Email Analyzer, sent for analysis. OpenAI's API data policy applies.

ResendNewsletter delivery

Your email address, if you subscribe to release notes.

PlausibleAnalytics

Cookieless, aggregated page-view statistics on other site pages. Plausible is omitted from the Research Workbench document.

Vercel BotIDBot protection for paid or write actions

Browser and request signals for protected actions such as email analysis and newsletter subscription. Its client SDK is not imported or initialized on the Research Workbench document.

UpstashRate limiting

Short-lived request counters keyed by a client identifier derived from your IP address. They expire automatically.

Retention

  • Tool inputs: not stored by NestCipher.
  • Research Workbench drafts: current page memory, with no autosave.
  • Opt-in local vault: encrypted records remain in this browser until you delete them or browser storage is cleared or evicted. NestCipher cannot recover them.
  • Optional research account: email and authentication records remain until the account is deleted on request. Essential account session cookies support sign-in and contain no vault passphrase.
  • Optional cloud backup: one encrypted snapshot remains until you explicitly replace or delete it, or the account is deleted. Supabase infrastructure backups may retain earlier encrypted copies under its retention policy.
  • Downloaded private files: remain on your device until you delete them.
  • Rate-limit counters: expire automatically within about a day.
  • Newsletter address: kept until you unsubscribe (every email has an unsubscribe link), or on request.
  • Infrastructure logs: held briefly by Vercel under its standard retention.

Your rights

Under UK GDPR you can ask for access to, correction of, or deletion of personal data we hold, including newsletter and optional research account information, object to or restrict processing, and take your data elsewhere. You can also complain to the Information Commissioner's Office (ico.org.uk).

Contact

Privacy questions and requests: hello@nestcipher.com. Security reports: see security.txt.