Privacy Policy
ReviewAhead is a hosted scanner: your project is uploaded to our server, read there, and its files are deleted when the scan ends. What we keep is the report and the details needed to recalculate it, for a limited time. This policy says what is kept, for how long, and who else is involved.
Last updated 21 October 2026
Who is responsible
The controller of the personal data described here is the trader below.
ReviewAhead is operated by A.S.Datadin, trading as Aurenix Creative Labs, registered in the Netherlands under Chamber of Commerce number 98214292. Registered business address: Laantje van Kempen 38, 2548 LL The Hague, Netherlands. VAT identification number: NL005316244B97. Contact: hello@aurenix-cl.com.
- Trader
- A.S.Datadin
- Trading as
- Aurenix Creative Labs
- Registered business address
- Laantje van Kempen 38, 2548 LL The Hague, Netherlands
- Chamber of Commerce (KvK)
- 98214292
- VAT identification number
- NL005316244B97
- hello@aurenix-cl.com
- Website
- aurenix-cl.com
For any privacy question or request, email hello@aurenix-cl.com. The same address handles support, complaints and refunds.
The short version
- ReviewAhead is a hosted scanner. Your project is uploaded to the scanner at app.reviewahead.dev and processed there, not on your machine.
- The uploaded archive and the files extracted from it are deleted when the scan ends, whether it finished, failed or was cancelled. A scan that stops to ask you a question keeps them until you answer or cancel, for at most about 30 minutes.
- The report is kept: the findings with short excerpts, file paths, your app’s name, bundle identifier, version and icon, your answers, and the project settings needed to recalculate it. A free report for 24 hours after the scan, a report you paid for for 365 days after payment.
- Your code is never executed. ReviewAhead does not train AI models on your project and does not sell it.
- Something from your project leaves our servers in only two cases, both of which you switch on: AI-assisted review, and a coding agent you connect. Both are described below.
- An account is optional for scanning, reading a report and buying a single report. The unlimited plan and scanning from GitHub need one.
What happens to an upload
The archive is streamed to a temporary file on the scanner and checked before anything is extracted. It is then extracted into a directory created for that scan alone, read as text, and both are deleted when the scan ends. Nothing in it is built, run or installed, and no address found in it is contacted. A repository you scan from GitHub is downloaded as an archive and handled the same way.
Deletion on every normal path is part of the scan itself. If the server stops in the middle of a scan, for example during a restart, a cleanup that runs every few minutes removes what was left, normally within about fifteen minutes of the server being back. That is the honest limit: files cannot be deleted by a server that is not running.
Where your code goes during a scan walks through the same steps in more detail.
What is kept, and for how long
| Data | Kept for | Details |
|---|---|---|
| Uploaded archive and extracted files | Until the scan ends | Deleted when the scan finishes, fails or is cancelled, and after about 30 minutes for a scan left waiting on a question. |
| A free report | 24 hours after the scan | Findings, excerpts, file paths, the app’s name, bundle identifier, version and an icon thumbnail of at most 128 pixels, your answers, and the settings parsed from the project (Info.plist values, build settings, entitlements, the privacy manifest, the dependency list and the list of file paths), so an answer can recalculate the findings. Answering a question does not extend this. It is then deleted by a cleanup that runs every hour, and it cannot be opened in the meantime. |
| The project list | 24 hours after the newest scan | The app’s name, bundle identifier and the date, score and version of each scan. |
| A report you paid for | 365 days after payment | The same contents as a free report. Deleting the project deletes it sooner. |
| A report you started to buy but did not pay for | 48 hours after opening checkout, or as long as the free report if that is later | A copy is made when checkout starts so that a slow payment cannot lose your report. It unlocks nothing. |
| A report on the unlimited plan | 24 hours after the scan, or 365 days after it once you change it | Opened in full while the plan is active. Answering a question or changing a finding keeps a copy for the longer period. |
| Your account | Until you ask us to delete it | Your email address, name and company if you give them, the App Store Connect app you picked, the ids of a GitHub connection, and when you accepted which version of these documents. |
| A stored App Store Connect key | Until you remove it | Only if you choose to store it for other devices: encrypted in your browser under a passphrase that is never sent, so we hold data we cannot decrypt, plus the key’s issuer id and key id. You can remove it on the upload screen. |
| Purchase and subscription records | 7 years | The email address you gave Stripe, the amount, Stripe’s ids, the status, and when you agreed to immediate delivery and in which wording. Your billing details stay with Stripe, on the invoice it keeps. Dutch tax law requires financial records to be kept this long. They are not yet deleted automatically after that; ask and we will. |
| Session cookie | 30 days | Signed and httpOnly. A random id, so your reports are filed under your browser. |
| Unlock cookie | 365 days | Set when you open a report you bought. Signed and httpOnly; it lists which reports this browser may open. |
| Sign-in return cookie | 30 minutes | Remembers which page to return to after you sign in. |
| Light or dark theme | 365 days, or until you clear it | Set only when you use the switch. It holds the word “light” or “dark” and carries your choice from this site to the app. |
| Your analytics choice | Until you change it or clear site data | Stored in your browser’s local storage. It holds your answer and nothing else. |
| Server logs | The hosting provider’s log retention period | Fly.io and Vercel record requests, including IP addresses and the addresses requested, and what the server writes. The server does not log file contents or findings. An unexpected error is logged with its message, which can name a file path or a repository, so that it can be fixed. |
Evidence excerpts are at most 200 characters, chosen by a rule, and credential-shaped values in them (API keys, tokens, private keys, passwords in a URL) are masked before they are stored. Whole files are not stored.
Records deleted from our database can remain in our database provider’s backups until those backups expire on the provider’s own schedule.
Signing in after scanning
You can scan without an account. If you later sign in on the same browser, everything that browser did while signed out (its projects, reports, single-report purchases and their paid copies) moves into your account, so nothing you scanned is lost by signing in. It is moved, not copied, and it keeps its original expiry, so signing in does not make a free report last longer.
On a shared computer, whoever signs in next on that browser takes what was scanned on it while signed out. Only work done while signed out moves, and only once. If you scan on a computer other people use, sign in before you scan, or sign out and clear this site’s cookies when you are done.
What leaves our servers
Apart from the providers listed further down, who process data for us, something from your project leaves our servers only in the cases below, each of which you start yourself.
AI-assisted review
AI review is part of the unlimited plan and off until you switch it on for a scan. The server checks the plan again when the scan starts, so a browser that remembers a yes from a plan that has lapsed sends nothing. When it runs, Anthropic is sent a summary of the scan: the permission purpose strings from your Info.plist (up to 400 characters each, credentials masked), the title, severity and explanation of up to 25 findings and the notes attached to their evidence, the target name, the bundle identifier, the kinds of functionality the scan detected (such as sign-in or purchases) and the names of the SDKs it found. Your files, your project tree and the evidence excerpts are not sent. The report says whether AI review ran.
What Anthropic does with that summary is governed by its terms for API customers. Anthropic states that it does not use API inputs and outputs to train its models and deletes them within 30 days, except content flagged for a usage-policy review, which it may keep longer.
Your coding agent
On the unlimited plan you can connect a coding agent, such as Claude Code or Codex, to ReviewAhead’s MCP server and sign in to it with your account. Only if you do, and only when your agent asks, it receives your reports as you would see them: findings, short evidence excerpts, file paths, the score and your answers. Your agent uploads your project the same way the website does, and it is handled exactly as an upload is. What your agent does with a report after that, including sending it to the AI provider behind it, is between you and that provider. You can disconnect an agent at any time in its settings.
App Store Connect
If you link an app, ReviewAhead asks Apple what Apple already holds about it. The request carries the app’s App Store Connect id and a signed token, and nothing from your project or your upload. If you connected your own API key, the key stays in your browser and is used to sign a token that lives about ten minutes; only that token reaches the server, which uses it for the scan and does not store it.
A review demo account’s password is never requested and never stored. Only whether a name has been filled in is recorded.
GitHub
Where you connect the ReviewAhead GitHub App, you choose which repositories it may read, one by one, on GitHub. It has read access to the contents and metadata of those repositories and nothing else, it never writes, and it cannot see a repository you did not pick. Changing or removing that choice on GitHub takes the access away immediately.
A repository you scan is downloaded and handled exactly as an upload is. Stored against your account are the installation’s numeric id, your numeric GitHub user id, the ids of the repositories in that installation that GitHub says you can see, and when it last said so. None of these can open anything. The token from connecting is used for those questions and then discarded, and every read runs on a token that is created for one hour from a key held only on the server. ReviewAhead asks GitHub again every few days, so a repository you lose access to stops being readable here too.
Analytics and cookies
Product analytics (PostHog, hosted in the EU) run on the home page, the scanner and the reports, in two tiers.
- Without your consent, before you answer and after you decline: page views and page performance figures are counted with nothing stored on your device. No cookie, no local storage, no recording, no profile.
- With your consent: clicks are recorded, a session recording is made, and a PostHog cookie lets a later visit be recognised. Two events are recorded as well: that a scan started, with whether it came from an upload or a repository and whether it was a rescan, and that it finished, with whether it ended in a report. Neither carries anything from the project or its name; like every analytics event, each carries the address of the page it happened on, with access tokens removed. On the scanner and the reports every piece of text is masked in the recording, and the recording never includes network requests, their contents or the browser console. Recordings are kept by PostHog for 30 days.
PostHog discards your IP address. Analytics never start on the sign-in, sign-up and onboarding pages, so nothing about them is recorded or sent. Error reports (Sentry) are described with the other providers below.
The site footer shows a badge image loaded from Launch Llama (tools.launchllama.co). Like any image from another site, loading it tells that site your IP address and browser.
Change or withdraw your analytics choice
Your answer is remembered separately by reviewahead.dev and by app.reviewahead.dev, so this control changes it for the site you are on now. Withdrawing stops the recording, resets your PostHog identity and removes what PostHog stored in this browser.
Reading your choice…
Who processes data for ReviewAhead
These providers process data on our behalf, only for what they are named for here.
- Stripe, payments, invoices and promotion codes, when you buy something. Your email address, billing address and payment details, entered on Stripe’s own page, and the id of the report you are buying. ReviewAhead never sees your card details.
- Supabase, the database: reports, projects, accounts and purchase records. Everything ReviewAhead stores, as described above.
- Clerk, sign-in, if you create an account. Your email address, your name if you give one, and sign-in events.
- Vercel, hosting of the website at reviewahead.dev. Ordinary web requests, including your IP address, in its logs.
- Fly.io, hosting of the scanner at app.reviewahead.dev, where uploads are processed. Your uploads while they are scanned, the server’s temporary files, and ordinary web requests, including your IP address, in its logs. Processed in Amsterdam, the Netherlands.
- Anthropic, aI-assisted review, only on a scan you switched it on for. The limited summary of the scan described under AI-assisted review, and nothing else.
- PostHog, product analytics on the website, the scanner and the reports. Page views and performance figures, and, only if you allow it, clicks, whether a scan started and finished, and a masked session recording. Your IP address is discarded by PostHog. Processed in the EU.
- Sentry, error monitoring. That something failed and what failed: the error, the browser or server it happened on and the page’s address with access tokens removed. Paths into your project and names from it are stripped first, and no session recording or IP address is attached. Processed in the EU.
- RevenueCat, records purchases, for the unlimited plan and for report unlocks. A pseudonymous customer id derived from your browser session or account, and the Stripe reference of each report you paid for and of an unlimited plan bought through Stripe, with which it reads that purchase from Stripe, the report’s id included. Where it sells the unlimited plan, also your account’s email address and name. Never anything about a project.
- Resend, email, for the confirmation and access link sent after you buy a report. The email address you gave Stripe and the message itself.
Apple (App Store Connect) and GitHub are not our processors: they answer requests you start when you connect them, under your own agreement with them.
Some of these providers process data outside the European Economic Area. Where they do, the transfer relies on an adequacy decision of the European Commission, such as the EU-US Data Privacy Framework, or on the Commission’s standard contractual clauses.
Legal bases
- Performance of a contract, for running the scan you asked for, AI review when you switch it on, delivering the report, your account, and handling your purchase.
- Legitimate interests, for keeping the service available and secure (rate limiting, error reports, server logs) and for the anonymous page count. These interests are balanced against your rights and do not extend to profiling you.
- Consent, for the analytics that record clicks and sessions. You may withdraw it at any time with the control above.
- Legal obligation, for keeping financial records.
Your rights
Under the GDPR you may ask for access to your data, correction, erasure, restriction and portability, and you may object to processing based on legitimate interests. Email hello@aurenix-cl.com and we will answer within one month.
Some of this you can do yourself. Deleting a project deletes it, every scan in its history, their settings and any paid copy of its reports at once; purchase records stay, because they are financial records. Reports also expire on their own, so deletion never depends on you coming back. To delete an account, email us: there is no self-service button for that yet.
If you withdraw from a purchase on the withdrawal page, the email address and invoice number you enter are used to find the purchase at Stripe and are not stored by us. The time we received the withdrawal is recorded with the payment at Stripe, and the confirmation is emailed to the address on the invoice through Resend.
You may also complain to a supervisory authority. In the Netherlands that is the Autoriteit Persoonsgegevens.
Children
ReviewAhead is a tool for people publishing software and is not directed at children. It is not knowingly used to collect data from anyone under 16.
Changes
This policy changes when the product does. The date at the top says when the current wording took effect. See also the Terms of Service and Refunds and Right of Withdrawal.