Privacy Policy
Last updated
RevRover is a free brand trust scanner run by Ellym LLC (Launch Supply), the team that builds and supports it. This policy explains what we collect when you use revrover.com, the weekly report and Slack alerts, why, who helps us run it, and how to ask us to delete it.
Questions or requests: hi@launchsupply.com, or by post to Ellym LLC (Launch Supply), 11816 Inwood Rd PMB 71541, Dallas, TX 75244.
When you run a scan
A scan looks only at public information about the website address you enter: its DNS records, its robots.txt and sitemaps, its public pages and public product feeds (such as /products.json). We store the address you entered, the scan's findings and when it ran.
To stop abuse we store a salted hash of your IP address with the scan, not the address itself, and use it only to limit how many scans one connection can run. If you arrived from a link with UTM or ?ref= tags, we store those tags with the scan so we know which channel brought you.
DNS checks send the scanned domain name (never anything about you) to Cloudflare's public DNS resolver.
Certificate checks send the scanned domain name, or a brand word taken from it or from the site's title, to the public certificate transparency search crt.sh (run by Sectigo) and, if that is unavailable, to Cert Spotter (run by SSLMate). Nothing about you is sent. Their answers are cached for up to 24 hours.
The staging-site check reads the robots.txt and front page of a few staging-style subdomains of the scanned domain (found in those certificate logs), and of any myshopify.com store linked from its homepage. It does so as RevRoverBrandTrustBot, with the same signing, pacing and robots.txt rules as for the scanned site, and never follows a redirect out of the domain.
Domain registration checks send the scanned domain name (never anything about you) to the public registration directory (RDAP) for its top-level domain, found through IANA's published list, and, if that doesn't answer, to the registry's public WHOIS server.
Our bot and the sites we scan
The RevRover bot only fetches public pages of sites someone asks us to scan. It doesn't log in, submit forms or add anything to a cart, so it never sees the private data of a scanned site's customers.
To check link previews, the bot also reads the first 64 KB of up to four share images (og:image) named by a scanned site's key pages. Images on the site's own domain are fetched like its pages; images on other hosts (such as an image CDN) are requested by address only. Nothing about you is sent.
Reports are unlisted
Every report has an unguessable link. Reports aren't indexed by search engines or listed anywhere on our site, but anyone with the link can open it, like a document shared with "anyone with the link". If a report link was shared somewhere you don't want, email us and we'll take it down.
A report shows how the scanned site's pages look when shared. The share images the site names are not loaded when you open a report: they load only if you choose "Show preview images". Your browser then fetches them directly from wherever the site hosts them, so, like any site your browser contacts, that host sees your IP address. We ask your browser not to tell it which report you were reading (no referrer), and only https images are shown.
The free weekly report and your account
If you sign up for the weekly report or sign in, we store your email address, the sites you watch, any other recipients you add, the UTM or ?ref= tags that brought you, and when each email was sent. We don't use passwords: we email you a 6-digit sign-in code. Codes are stored only as a hash, expire after 10 minutes and work once. With each code request we store a salted hash of your IP address, used only to limit how many codes one connection can request.
When you sign up we send a welcome email with the site's latest report (once a scan has finished), then the weekly report for each site you watch until you unsubscribe. People you add as recipients get one email asking them to confirm, and nothing more unless they do. Every weekly email has a one-click unsubscribe link, and you can stop watching a site from your dashboard.
When you sign up, Launch Supply is notified with your email address, the site, the report, and the UTM or ?ref= tags that brought you, and may get in touch about fixing what your report found. If you'd rather not hear from us, reply to say so and we'll stop.
If you ask us to send you, or to stop sending you, the short welcome emails from the Launch Supply team, we keep a record of that choice: your email address, when and how you made it, your country, and the site and UTM or ?ref= tag that brought you. Those emails are separate from the weekly report.
When you're signed in, your browser loads your profile picture from Gravatar, a service run by Automattic. To find it, Gravatar receives a SHA-256 hash of your email address (and, like any site your browser contacts, your IP address). If you don't have a Gravatar, we show your initial instead.
Slack
If you connect Slack, we store the incoming-webhook address and channel name Slack gives us, and use them only to post your weekly report and test messages. Removing the Slack recipient in your dashboard stops all posts; email us to have the stored webhook deleted.
Contact, waitlist and fix requests
When you contact us, join the Pro or Shopify app waitlist, ask about affiliates or ask Launch Supply to fix something, we store your name, email address, company or site, your message, the UTM or ?ref= tags that brought you (if any), a salted hash of your IP address and your browser's user-agent string. A fix request also records the report it's about. Launch Supply receives a copy by email so we can reply.
The Shopify app
The RevRover Shopify app isn't open for installs yet. Before it is, this section will explain exactly what the app reads from Shopify and what we store. Joining the Shopify app waitlist is covered under "Contact, waitlist and fix requests" above.
Who helps us run RevRover
We share personal information only with the providers below, which may process it in the United States and other countries. We don't sell or rent your personal information, and we don't use it for advertising.
- Cloudflare: hosting, database, DNS lookups, Email Sending (sign-in codes, weekly reports and notifications), DMARC reports about email sent from our domain, and Turnstile, which checks that forms are sent by a person.
- Google: Google Fonts, which serves the site's typefaces and so receives your IP address when a page loads.
- Gravatar (Automattic): profile pictures for signed-in visitors.
- Slack: only if you connect it.
- Launch Supply: receives contact messages and new weekly-report sign-ups, as described above.
How long we keep it
We keep scans, reports, your account and your watched sites while RevRover runs, so your weekly reports can compare with earlier scans. We don't yet delete old data automatically; when we start, we'll update this page. Sign-in codes expire after 10 minutes and sessions after 30 days without use. Email us to delete your data and we will, except for records we must keep by law.
Your choices and rights
You can ask for a copy of your information, ask us to correct or delete it, or object to how we use it, by emailing hi@launchsupply.com. Depending on where you live (for example under the GDPR, UK GDPR or California law), you may also have the right to complain to your data protection authority. We'll answer within 30 days.
RevRover isn't meant for children under 16, and we don't knowingly collect their information.
Changes
We'll update this page and its date when our practices change.