Privacy

What this site collects

Short, because there is not much of it. We collect what the service needs to run and nothing that would be useful to somebody else.

Who holds this

Growthfolio, LLC, at 6 Orchard Street, Concord, NH 03301, United States, operates SecondDoor and is responsible for the data described here. Anything you want to ask, correct or have deleted goes to privacy@seconddoor.io, and a person answers within one working day on working days.

What is stored

The address you scanned, the report derived from it, and the sequence of checks that produced it. Reports are public at a permanent address.

Work email addresses

An account stores your email address, a hash of your password if you set one, your plan, and the domains you asked us to watch. Entering an email to see the evidence on a report stores that address alongside that report. Nothing here is sold and nothing is shared.

Payment details

When you pay for a plan, your card details are entered directly with Stripe, our payment processor, and never reach our servers. We hold a customer reference, your plan, the dates of your billing period and your invoice history. We do not have your card number and cannot see it. The payment step is subject to Stripe's own privacy policy.

Cookies

One cookie holds a signed list of the reports whose evidence you have opened. A second holds your sign-in, if you have an account, and a third exists for a few minutes while a Google sign-in is in flight. There is no analytics, no advertising and no third party tracking script anywhere on this site.

IP addresses

Held briefly in Redis to enforce scan rate limits, and expired within the hour. Not written to the database and not attached to reports.

What is sent to a model provider

During a scan, the pages the scanner read are sent to Anthropic's API to write the report. That happens only while a scan runs. Viewing a report, a guide or any other page here sends nothing to anyone.

Who else touches it

Four, and no more than four. Each one receives only what it needs to do its job, and none of them receives your data to use for their own purposes.

/Stripe, for payments and invoicing. It receives your email address and the payment details you enter with it.

/Anthropic, for writing reports. It receives the pages the scanner read during a scan, and nothing about you.

/Our hosting provider, which runs the application and the database the account lives in.

/A Redis cache, holding rate limit counters that expire within the hour.

How long it is kept

Different things for different reasons, and the reason is always the point rather than the convenience.

/Reports stay up until the site's owner asks us to retire one. Proving you control the domain is the only requirement, and the index policy sets out exactly what withdrawal destroys and what it keeps.

/The pages the scanner read during a scan are kept with the report for six months, and ninety days for sites in the EU, then dropped. The scores and the report itself outlive them.

/Account data is kept while the account is open, and removed when you close it.

/Rate limit records expire within the hour.

/Billing records outlive the account, because tax and accounting law requires it.

Removing a report

Prove you control the domain and you can retire its report. Start at /claim, or write to privacy@seconddoor.io with the link. Withdrawal retires the address and destroys the company name, the written analysis, the evidence and any screenshots. What remains is a row with no name attached, carrying the kind of site it was and the numbers, because if leaving also removed the numbers then every published median would move each time somebody asked. Say the word and those go too, which is the right of anyone whose domain is personal rather than corporate and is available to everybody else on request. Closing your account removes the account and everything it holds; it does not by itself retire a report, so withdraw first if that is what you want.

What you can ask for

Write to privacy@seconddoor.io from the address on your account and you can ask for a copy of what we hold about you, a correction to any of it, the deletion of your account and its contents, or the removal of a report. We reply within one working day and act within thirty days.

We do not sell your information

We do not sell personal information, and we do not share it for cross context behavioural advertising. There is no opt out to offer you, because there is nothing to opt out of.

Where it is held

On servers in the United States. If you use the service from somewhere else, what you send us is processed in the United States.

Children

This is a service for businesses and is not directed at children. We do not knowingly collect information from anyone under 16, and if we learn we have, we delete it.

Changes

If this policy changes, the version on this page is the one that applies, and the date below says when it last moved. A change that materially affects what we collect is sent to the address on your account before it takes effect.

Last updated 2 September 2026.