Privacy notice

1. Your account

When you sign up we hold your email address and a password (stored as a hash by our sign-in provider, Supabase). We also hold your organisation name, the projects you add, and a record of when you accepted the terms for each project. We use this to run your account, which is the contract between us. We keep it while your account is open.

2. AppGuard: tests of your app

You add an app and prove you own it. We then send read-only requests to it and to the Supabase address named in its public code. We store what we found as counts, fingerprints and the first eight characters of a key, together with scan times and request counts. We do not store table rows, files, response bodies or full keys. If you delete a project it is removed from your workspace straight away and permanently erased 30 days later. Email us if you want it erased sooner.

3. SwarmWatch: web traffic you send us

If you connect a host or send web logs, we act for you as a processor: you decide what is sent and why. Logs sent to the analyse-only route are checked in memory and discarded. Visits sent by a connected host are reduced and held in a rolling record for up to 60 minutes, then deleted. The record holds a keyed code in place of each visitor address, the shortened network, the page pattern with numbers removed, the method, status and time. We do not store addresses, query strings, cookies, headers or bodies. What lasts is the alert summary: a time window, counts, page patterns, shortened networks and an explanation. Deleting a site deletes its rolling record.

You should have a lawful basis for sending visitor traffic data to us (protecting your site is a common one) and mention it in your own privacy notice.

4. AgentGate: your agents’ tool requests

We store which agent asked to use which tool, the rule outcome, a short summary and the names of the details sent. We do not store the values. To spot an agent repeating the same call, we keep a coded fingerprint of each call for one hour, then delete it.

5. Fix drafts (optional)

If you switch this on for a finding, we read a small number of relevant files from your GitHub repository (secrets removed, environment files never read) and send them to our AI model provider, Anthropic, to draft a change. We open a pull request on a separate branch for you to review. We keep the repository name, the installation number and the outcome of each attempt, never your code or the change itself.

6. Our research decoys

We run decoy web apps that hold only fake data, to study how exposed apps are found. If you visit one we record the time, page (numbers removed, no query string), response, browser or tool family, the shortened network (a /24 for IPv4, a /48 for IPv6) and a code that changes every week. We never keep your full address, cookies or anything you send. Our legal basis is legitimate interests, in security research that helps people building apps. Records are deleted after 90 days. We publish totals only, hiding small groups, on our research page. Each decoy has its own short notice. To object or ask for deletion, email us.

7. Research lab members

Approved researchers join with an unlock code. We hold their email address, their role and access dates, the author profile and byline they choose, and what they add to the lab: discussion posts, questions, detection rules, challenge entries, re-checks and draft reports. We also keep a record of admin actions, such as who was given access. We use this to run the lab under the researcher rules they agree to when they join, and in our legitimate interests in running the lab responsibly. A published report shows only the byline the author chose. The lab shows researchers totals only, never individual visitors, and small groups are hidden. The daily security data we show them comes from public sources and contains no personal data.

8. The War Room game

War Room is an attack-and-defend game on an invented app. Nothing in it touches a real system or anyone else’s data. Every match you play is recorded; only the guided tutorial is not. After you accept a notice, we keep each plan you commit (the menu choices and targets you picked, the time you took, and what happened), the match result and a code that changes every week, for 12 months. We use them under our legitimate interests in research on how people attack and defend. Researchers see totals only, and any figure with fewer than 5 different players behind it is hidden. Leaderboards show your username. The replay on our home page is two computer players and contains no one’s data. Nothing you type freely is stored. To object or ask for deletion, email us.

9. Contacting us and the help assistant

If you use our contact form we keep your name, email address, the topic and your message so we can reply. We keep them for 12 months, then delete them. We do not store your internet address with the message.

If you use the in-app help assistant, we keep your questions and its answers for 90 days so we can improve the product, and send them to Anthropic, which runs the AI model, to produce the answer. The assistant cannot see your scans, projects or lab data, and we ask you not to paste passwords or keys. We also keep short summaries of ideas and problems raised, without names or contact details, for as long as they are useful.

10. This website

We use only what is needed to sign you in: your sign-in session is kept in your browser’s storage. We do not use advertising or analytics cookies. Our hosting provider and servers keep ordinary technical logs for a short time to keep the service running.

If you arrive from a link in one of our posts on X, the page adds one to a running count for that campaign, post, page and UK hour. That count holds no address, browser details, cookie or time of day, and nothing is stored on your device, so it cannot be tied to you or to any other visit. We do not count visits from browsers that send Do Not Track or Global Privacy Control. The counts are kept for up to 13 months.

11. Who else handles data

We use these providers to run the service: Supabase (sign-in and database), Fly.io (our servers, in London), Lovable (the website), GitHub (only if you use fix drafts) and Anthropic (only if you use fix drafts or the help assistant). When you choose a password, your browser also checks it against known breaches with the Have I Been Pwned service: only the first 5 characters of a one-way hash leave your device, never the password. We do not sell personal data or use it for advertising. Some providers may process data outside the UK; where they do, we rely on their safeguards for international transfers.

12. Your rights

You can ask to see, correct, delete or move your data, restrict or object to how we use it, and withdraw consent where we rely on it. Email info@mithos.co.uk. If you are unhappy, you can complain to the Information Commissioner’s Office at ico.org.uk.

13. Changes

We will update this page when what we do changes, and change the date at the top.

Who we are

BlueSwarm is a product of Mithos Limited, registered in England and Wales, company number 17459676. Registered office: 9 Crake Valley Road, Harwell, OX11 6LS. ICO registration ZC249870. Contact: info@mithos.co.uk.