Privacy policy

The short version: your scans never leave your computer, the free tier needs no account, and the only personal data we hold is what is required to run a subscription.

Who we are

ScanWRX is published by Raging Rhino Group, LLC, a limited liability company. ScanWRX is part of the CompanyWRX product family. Questions about this policy go to privacy@companywrx.com.

Your scan data

We never receive the results of your scans. Not the addresses, not the hardware addresses, not the hostnames, not the device names, not the services, not your notes.

Scans are stored in a SQLite database inside your own Windows profile, at %APPDATA%\CompanyWRX\ScanWRX. The application has no code path that uploads it. If a synchronisation feature is added in future it will be opt-in, it will be described here before it ships, and it will remain off until you switch it on.

This matters more than it might sound. The networks you scan usually belong to your clients, not to you, and you are frequently under an obligation not to disclose their contents. A tool that quietly uploaded that information would put you in breach of agreements you signed. So it does not.

What we do collect

Nothing, if you use Free: ScanWRX Free requires no account and makes no outbound connection beyond the network you are scanning. We do not know you exist.
Your email address: If you create an account. It is how you sign in — there is no password — and how we contact you about your subscription. Retained while the account exists.
Your activated computers: A random identifier the application generates for itself, a label so you can tell your machines apart, and the application and Windows version. The identifier is not derived from your hardware. Retained while the device is activated.
Subscription state: Which plan you are on, whether it is active, and when the period ends. Retained for seven years after the subscription ends, because tax law requires it.
Payment details: None. Checkout runs on Stripe. Your card number never reaches our servers. We can see the last four digits and the expiry that Stripe shows us; we cannot see the number.
Download counts: Which version was downloaded, when, and a truncated address — the first three octets of an IPv4 address, so 203.0.113.0/24 rather than a specific machine. That is enough to notice abuse and not enough to identify a person. Retained 90 days.
Support messages: Whatever you write to us, so we can answer it and so the next person with the same problem gets a better answer. Retained while it is useful for support, and no longer than two years.
Server logs: Ordinary web server logs. Retained 30 days, then deleted.

Analytics and tracking

This website uses no third-party analytics, no advertising pixels, no session recording and no cross-site tracking. There is no Google Analytics tag, no Facebook pixel and no advertising network on any page you have loaded here.

We keep one cookie, swx_session, and only after you sign in. It holds a random session identifier and nothing else. There is no cookie banner because there is nothing to consent to: the only cookie is the one that keeps you signed in, which is exempt from consent requirements in every jurisdiction we are aware of.

Four processors, each doing one job:

Stripe — payments and subscriptions. They hold your card details; we do not.
Resend — sends your sign-in links and our replies to you.
DigitalOcean — hosts this website and its database, in the United States.
GoDaddy — DNS for the domain.

We do not sell your data, we do not rent it, and we do not share it for anyone else’s marketing. We would disclose it if a court validly ordered us to, and we would tell you unless we were legally prohibited from doing so.

Your rights

Wherever you are, you can ask us to show you what we hold, correct it, or delete it. Email privacy@companywrx.com and we will do it within 90 days, usually within two business days because there is not much to look at.

Deleting your account removes your email address, your device records and your entitlements. It does not remove the subscription and invoice records we are legally required to keep, and it does not touch anything on your own computer — your scans and your exports are yours and stay where they are.

If you are in the UK or EU, our lawful basis is contract for everything needed to provide the subscription, and legitimate interest for security logging and abuse prevention. If you are in California, we do not sell or share personal information as the CCPA defines those terms, so there is nothing for you to opt out of.

Security

There are no passwords in our database, because ScanWRX does not use passwords — signing in means opening a single-use emailed link. Sign-in tokens and session tokens are stored only as SHA-256 digests, so reading our database does not yield anything that can be presented as a credential. Traffic is TLS-only.

The desktop application’s own security properties — what it opens, what it sends — are described in detail, with measurements, on the security page.

Children

ScanWRX is a professional tool and is not directed at children. We do not knowingly collect anything from anyone under 16.

Changes

If we change this policy materially we will email everyone with an account before it takes effect. The effective date at the top of this page always reflects the current version.