This Privacy Policy applies to the hosted Threatless service operated at trythreatless.com and the Scan API at api.trythreatless.com (together, the “Service”). For questions, contact contact@trythreatless.com.
Threatless is a malware-scanning product for developers. The legal entity that operates the Service should be completed with company registration details in the Legal notice. Until that filing information is published, “Threatless” refers to the operator of trythreatless.com.
1. Who is responsible
For account data, billing identifiers, and scan metadata created when you use the hosted Service, Threatless acts as the data controller. For file bytes that you submit solely so we can return a malware verdict, Threatless acts as a processor on your instructions, as described in the Data Processing Addendum.
Self-hosted deployments that you run on your own infrastructure are outside this policy. In that case you are the controller of data on your instance.
2. Data we collect
Account data
- Name, email address, and password hash (BCrypt) for email sign-up
- Google account identifiers if you choose Google sign-in
- Email confirmation and password-reset tokens, for a limited time
- Plan (pack), Stripe customer and subscription identifiers when you pay
- API keys you create, including name, value, creation time, and last use
Scan metadata
- Original filename (or the last path segment of a scanned URL)
- Whether ClamAV reported a signature, and the signature name if any
- Size in bytes and scan duration
- HTTP status recorded for the scan, timestamps, and environment label
File contents and remote URLs
Uploaded files and bytes downloaded from a public URL are streamed to ClamAV in memory using the INSTREAM protocol. Threatless does not store file contents after the verdict is returned. URL scans are limited to public http and https resources; private, loopback, link-local, and cloud-metadata targets are rejected.
Technical and session data
- A short-lived access JWT stored in a first-party
tokencookie on the web app - An httpOnly refresh-token cookie set by the API
- Session metadata used so you can list and revoke devices
- Standard server logs (time, route, status) needed to operate and debug the Service
The hosted marketing site does not currently load third-party advertising or analytics pixels. See the Cookie Policy.
3. Why we process data
- To provide the Service — create accounts, authenticate you, scan files, enforce hourly quotas, and show history in the dashboard.
- To bill paid plans — Stripe processes payment details; we store the identifiers required to map a subscription to your account.
- To secure the Service — detect abuse, enforce SSRF protections on URL fetches, and revoke sessions.
- To communicate with you — confirmation, password reset, and responses to mail sent to contact@trythreatless.com.
- To meet legal obligations — tax, accounting, and responding to lawful requests.
Where the GDPR applies, we rely on performance of a contract for account and scanning operations, legitimate interests for security and service improvement that does not override your rights, consent where a non-essential cookie would be introduced (none are used today), and legal obligation where the law requires retention.
4. Who we share data with
We do not sell personal data. We share it only with:
- Stripe — payment processing for paid plans
- Infrastructure providers — hosting, object-free compute, and email delivery needed to run trythreatless.com
- You — via the API and dashboard, including JSON scan results
- Authorities — when required by law
ClamAV runs inside the Threatless API environment. File bytes are not sent to a separate consumer antivirus cloud for the hosted scan path.
5. Retention
- File bytes — not retained after the scan completes or fails
- Scan metadata — kept while the account exists so you can audit results, unless you ask us to delete the account
- Account data — kept while the account is active
- Billing records — kept as required for accounting
- Session cookies — access tokens expire in 15 minutes; refresh cookies last 15 days or until logout / revoke
6. International transfers
The Service may be hosted or accessed from more than one country. Where personal data leaves the European Economic Area, we use appropriate safeguards such as the European Commission’s Standard Contractual Clauses with subprocessors, or an adequacy decision, as applicable.
7. Your rights
Depending on your location, you may have the right to access, correct, delete, restrict, or port your personal data, to object to certain processing, and to withdraw consent. Email contact@trythreatless.com to exercise these rights. You may also lodge a complaint with your local supervisory authority.
To delete an account and associated scan metadata, write to the same address from the email on the account. We may retain limited billing records where the law requires it.
8. Children
The Service is intended for professional use by adults. It is not directed at children under 16, and we do not knowingly create accounts for them.
9. Security
We use HTTPS on the hosted product, hashed passwords, short-lived access tokens, httpOnly refresh cookies, SSRF controls on URL scans, and in-memory scanning so file contents are not written for the scan itself. No method of transmission or storage is perfectly secure. Report suspected vulnerabilities to contact@trythreatless.com.
10. Changes
We may update this policy as the Service changes. The “Last updated” date at the top of this page will change. Material changes will be reflected here; continued use of the Service after an update constitutes acceptance of the revised policy where permitted by law.
11. Contact
Privacy requests: contact@trythreatless.com. Related documents: Terms of Service, Cookie Policy, DPA, Legal notice.