Privacy Policy

This Privacy Policy explains how Atypical Co. (“Atypical,” “we,” “us,” or “our”) collects, uses, and protects information in connection with the Acanon website at acanon.atypical.co and the Acanon scanning service (together, the “Service”). It applies to the public, free resistance scan and to any report we email you.

The short version

• When you scan an app, the binary you choose is uploaded to our analysis service, read statically to produce a score, and then deleted. We do not run it, keep it, or use it to train anything.
• We never store the actual secret values found inside a binary. A finding records only its kind, severity, and count (for example, “one API key, critical”), never the value itself.
• If you ask us to email you the full report, we collect your email address and keep it so we can send the report and, unless you opt out, occasional related messages.
• We use Google Analytics to understand how the site and the scanner are used. You can opt out, and we never send your email, file names, or file contents to analytics.

Information we collect

Files you submit for analysis

To produce a score, you upload an application binary (such as a Windows .exe, a macOS app or disk image, or an installer). Installers and disk images are unpacked in your own browser; only the application binary inside is uploaded. The binary is the input to the analysis and is handled as described in How we handle your binary below.

Your email address

Emailing yourself the full report is optional. If you choose to, we collect the email address you enter so we can deliver the report and add you as a contact (a “lead”) so we can follow up about Acanon. You are never required to give an email address to see your score on the page.

Information collected automatically

• Usage and analytics. Through Google Analytics we collect standard analytics data (pages viewed, approximate location derived from IP, device and browser type, referring site) and a small set of non-identifying events about scanner use: that a scan started, that a scan completed (with the resulting grade, rounded score, and binary format), that a scan failed, and that someone requested an emailed report. These events never include file names, file contents, paths, discovered secret values, or your email.
• Technical and security data. Our servers process your IP address and request metadata transiently to route the upload, enforce rate limits, and protect the Service from abuse. We do not retain the raw request logs tied to your upload.

Cookies and similar technologies

Google Analytics sets cookies (for example _ga) to measure usage. These are analytics cookies, not advertising cookies. You can block or delete them in your browser, use the Google Analytics opt-out add-on, or send a Global Privacy Control / Do Not Track signal, which we honor as an opt-out of analytics where technically supported.

How we handle your binary

This is the part that matters most, so it is explicit:

• We never execute it. Analysis is static: we parse and measure the bytes. The uploaded file is never run as a program.
• It is deleted after analysis. The upload is written to a temporary location inside an isolated analysis machine only for as long as the scan takes, then removed. We do not keep a copy of your binary after the score is produced.
• Secret values are never stored. When the scanner detects something like a key, token, or build path, it records the kind, severity, and count for your report, never the underlying value.
• We do not use your binary to train models or share it with third parties, and we do not inspect it beyond producing your score and report.
• The score and report we return are cryptographically signed so that neither you nor anyone else can present an altered score as ours. That signature carries the report fields, not your file.

How we use information

• To run the scan, produce your score, and show your report.
• To email you the full report when you ask, and to contact you about Acanon unless you opt out.
• To measure and improve the Service through aggregate analytics.
• To secure the Service, enforce rate limits, prevent abuse, and comply with law.

Legal bases (EEA / UK)

Where the GDPR or UK GDPR applies, we rely on: consent (for sending you marketing email and for analytics cookies); performance of a contract or steps at your request (to run a scan you initiate and deliver the report you request); and our legitimate interests in securing and improving the Service, measured against your rights.

Service providers

We use a small number of processors who handle data on our behalf under contract and may process it in the United States:

If you are outside the United States, using the Service transfers your information to the United States and other countries where our providers operate. Where required, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

Data retention

• Uploaded binaries: deleted immediately after the scan; not retained.
• Score and report: delivered to you; if you requested an email, a copy of that email exists in our email provider’s systems.
• Email / lead data: kept until you ask us to delete it or unsubscribe and we remove it.
• Analytics: retained for the period configured in Google Analytics.

Your rights and choices

Depending on where you live, you may have the right to access, correct, delete, or port your personal information, to object to or restrict certain processing, and to withdraw consent. Under U.S. state laws such as the California Consumer Privacy Act (as amended by the CPRA), you may request access to and deletion of your information and may opt out of its “sale” or “sharing.” We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We will not discriminate against you for exercising these rights.

To exercise any right, or to be removed from our contact list, email us at hello@atypical.co. Every marketing email also includes an unsubscribe link. We will verify your request as required by law before acting on it.

Security

We use HTTPS everywhere, isolate the analysis environment, authenticate uploads with single-use tokens, rate-limit abuse, and minimize what we store. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security.

Children

The Service is for businesses and professionals and is not directed to children under 16. We do not knowingly collect personal information from children.

Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above, and material changes will be reflected on this page.

Contact us

Atypical Co.
Email: hello@atypical.co
Web: atypical.co