What JoeScan processes, what stays on your device, and how to manage your information.
JoeScan is a product of JoeTech. This page describes data handling in the current product, including its scan tools and optional features.
The password checker processes the password in your browser. Only the first five characters of its SHA-1 hash are sent to the Pwned Passwords range service. Saved password scans use a generic label rather than the password.
When signed in, completed scans may be saved with your account. Other than password values, this can include the target you entered and the resulting report.
| Data | Location and purpose |
|---|---|
| Account & profile | Firebase Authentication and Firestore hold account details such as your email, display name, profile image, preferences, and academy progress. |
| Scan history | Firestore stores scan targets and reports associated with your account. Password scans use “Password check” as the target. |
| Browser preferences & chats | Browser storage retains language, theme, and scan-attempt timestamps. Assistant conversations remain in page memory and are cleared on reload or account change. |
| Personal API settings | Keys you enter stay in memory for the signed-in session and are cleared on reload or sign-out. Using a key sends it to the relevant provider or through the configured request path; local storage does not mean the key is never transmitted. |
| Optional features | Watchlists, team settings, support requests, activity records, and webhook configuration may store additional information when used. Enabled webhooks can send scan summaries to your configured destination. |
Firebase manages authentication and supported two-factor enrollment. Firebase App Check uses reCAPTCHA for abuse protection. Hosting and service providers also process connection information, such as IP addresses, to deliver requests.
Not every check is local. Depending on the tool and settings you use, inputs are sent to external services:
These providers have their own privacy policies and retention practices. Avoid submitting confidential information that a check does not need.
Scan history: saved results remain until deleted. There is currently no automatic expiry period for scan history. Use the History page to remove results.
Browser data: preferences remain until cleared; chat history is not persisted. Clearing browser data does not delete cloud records.
Account deletion: the account-delete control requires recent sign-in, blocks further account use, and removes owned scans, watchlists, API key records, profiles, support records, username mappings, invitations and related application records before removing the authentication account. If interrupted, retry to resume. A minimal deletion-status record is retained to prevent stale sessions from recreating data.
Deletion timing: cleanup runs in batches during your deletion request. Backups, provider logs, externally delivered webhooks and reports you downloaded are not removed by this operation; contact JoeTech for requests involving those copies.
To request access, correction, or deletion, email us or use the in-app support system. Include enough information to identify your account, but never send your password or API keys.
joetech.dev.systems@gmail.com ↗This policy may change as the product evolves. The update date is shown at the top of this page.
Back to JoeScan →