Privacy Policy
Last updated: 15 October 2026
Who we are
ModelCanary (this website) is a free service run by an independent operator in Ireland, who is the data controller. Contact: hello@purplefrog.ie. Postal address: 340 Kylemore Road, Ballyfermot, D10YH30, Ireland.
What we collect
- Newsletter: your email address, the time you signed up and confirmed, which form you used, and two random tokens for confirming and unsubscribing. We only collect this if you subscribe.
- Abuse protection: a salted, one-way hash of your IP address when you submit the signup form, so we can limit repeated attempts. The IP address itself is not stored. A hash like this is still personal data. It is deleted after at most 1 day.
- Repo scanner (/scan): the repository you enter is fetched from GitHub, matched against our event list and the result is held in server memory for about 10 minutes. It is not saved to our database. GitHub receives the repository name, from our server, not your browser.
- Server logs: our hosting provider (Vercel) keeps short-lived technical logs of requests (such as IP address, user agent and URL) for security and troubleshooting.
Why we use it, and our legal basis
- Sending the email digest (once it starts) and its confirmation email: your consent (Article 6(1)(a) GDPR). You can withdraw it at any time with the unsubscribe link, and we delete your address.
- Rate limiting, abuse prevention and server logs: our legitimate interests in keeping the service secure and available (Article 6(1)(f)).
Giving us your email is optional. Without it you can still use the whole site. We don't sell your data, don't use it for anything else and don't make automated decisions about you.
Who handles data for us
- Resend (email delivery, USA): your email address and the message.
- Supabase (database, hosted in the EU, Ireland): the data described above.
- Vercel (website hosting and logs, USA, with functions run in Dublin): request data.
- GitHub (USA): receives the repository name when you use the scanner.
Where data goes outside the EU/EEA, this relies on the provider's Standard Contractual Clauses or EU-US Data Privacy Framework certification.
How long we keep it
- Confirmed subscribers: until you unsubscribe, when your address is deleted straight away.
- Unconfirmed signups: deleted automatically after 30 days.
- Hashed IP for rate limiting: deleted automatically after at most 1 day.
- Repo scan results: about 10 minutes, in memory only.
- Send records (a counter of emails sent, with no email address): kept to stay within our email limits.
Your rights
You can ask us to access, correct, delete or export your data, to restrict or object to its use, and to withdraw consent at any time. Email hello@purplefrog.ie. You also have the right to complain to the Irish Data Protection Commission at dataprotection.ie.
Cookies, tracking and fonts
This site sets no cookies and uses no analytics, advertising or tracking pixels. Fonts are served from our own domain, and we load no third-party scripts in your browser.
Children
ModelCanary is not intended for anyone under 16. If you believe a child has given us their email address, contact us and we'll delete it.
Changes
If we change this policy we'll update the date above.