Privacy Policy

1. Who we are

Tarnover LLC (“Tarnover,” “we,” “us”) operates flawharbor.com and cve.bz and is responsible for the personal information described in this policy. You can reach us about privacy at privacy@flawharbor.com.

2. What this policy covers

This policy covers:

• flawharbor.com, our marketing website;
• the Flawharbor Cloud beta signup at flawharbor.com/join.html;
• cve.bz, our free public vulnerability database: its pages, public API, RSS and JSON feeds, MCP server and the “check your stack” tool.

It does not cover:

• Flawharbor Cloud (app.flawharbor.com). Information that customers and their users put into Flawharbor Cloud is governed by the customer’s agreement with us and its data processing terms.
• Self-hosted Flawharbor. Flawharbor is open-source software. An organization that runs its own copy, including its own public vulnerability pages, is responsible for the information it collects, under its own policies.
• Other websites we link to, such as the sources of the vulnerability data. Their own policies apply.

3. What we collect

When you join the beta list

When you submit the signup form, we store:

• your email address;
• the updates you chose (private beta invitations, the public launch, or both);
• that you agreed to receive those updates, and which version of the signup wording you agreed to;
• when you first signed up and when you last changed your choices;
• a keyed hash of your IP address. We compute it with a secret key and do not store the address itself. We use it to stop the form being flooded with repeated attempts.

To enforce that limit, we also keep a short-lived counter of attempts per keyed hash. Each counter covers one minute and is deleted automatically soon after. When someone new signs up, we send ourselves a notification email containing the email address and the updates chosen.

When you browse flawharbor.com

Like every website, ours receives your IP address, browser details and the pages you request, because your browser needs them to load the site. Our hosting provider, Amazon Web Services (AWS), processes this information to deliver the pages and protect its network. We have not turned on access logging for flawharbor.com, so we do not keep a record of your visits. The service that handles the signup form keeps operational logs for 30 days; it is built not to record email addresses or IP addresses in them.

When you use cve.bz

cve.bz has no accounts, no sign-in and no forms that ask for personal information. When you visit its pages or use its API, feeds or MCP server:

• Server logs. Requests pass through AWS CloudFront to our server, which writes a log entry for each request. An entry can include your IP address, the time, the address requested, your browser’s user agent and the response. We use these logs to keep the service running and secure, and they are overwritten as new entries are written.
• Rate limits. To limit how many stack checks one client can run, our server keeps your IP address (for IPv6, the /64 network it belongs to) with a counter in memory. It is not saved to a database. If an address goes over the limit, the server log records the address and how many checks were refused, at most once a minute per address.
• Check your stack. When you check a lockfile or software bill of materials (SBOM), on the page, through the API or with the MCP check_stack tool, we read the file in memory, match its packages against the advisories we store, send you the result, and discard the file. We do not store the file or the result in a database, a log or a cache.

When you contact us

If you email us, we receive your email address and whatever you choose to include, and we use it to reply.

4. Cookies and browser storage

flawharbor.com and cve.bz do not set cookies. They do not use analytics, advertising or tracking tools, and they load no scripts or fonts from other companies; everything, including fonts, comes from our own servers.

cve.bz has a theme chooser (system, light or dark). Your choice is saved in your browser’s local storage, under the name fh.theme, so the next page uses it. It stays in your browser and is never sent to us. You can clear it with your browser’s site data settings.

5. How we use information

• to send the beta invitations and launch announcement you asked for;
• to run, secure and troubleshoot our sites, including limiting abuse, spam and automated traffic;
• to answer your messages and requests;
• to comply with the law and to protect our rights and the rights of others.

We do not sell your personal information, use it for targeted advertising, or build profiles of visitors.

6. Legal bases (EEA and UK)

If you are in the European Economic Area or the United Kingdom, we rely on these legal bases:

• Consent for the beta and launch emails. You can withdraw it at any time; doing so does not affect emails already sent.
• Legitimate interests for server logs, rate limiting and other security measures, and for running cve.bz. Our interest is keeping the services available, secure and free of abuse; we keep the information involved to a minimum.
• Legal obligation where the law requires us to keep or disclose information.

7. Who we share it with

We share personal information only as follows:

• Service providers. AWS hosts our sites and stores the signup list (Amazon S3, CloudFront, Lambda, DynamoDB and SNS, in the US West (Oregon) region, with CloudFront locations worldwide). Email from us is sent through Amazon Simple Email Service. AWS processes this information on our behalf and under our instructions.
• Legal reasons. When we believe in good faith that the law requires it, or to protect the safety, rights or property of our users, the public or Tarnover.
• Business transfers. If Tarnover is involved in a merger, acquisition or sale of assets, personal information may transfer as part of it, and this policy will continue to apply to it.

8. How long we keep it

• Beta signups: until you unsubscribe or ask us to delete your signup, or until we no longer need it to send the updates you chose. Our database keeps backups for up to 35 days, so a deleted entry leaves the backups within that time.
• Signup rate-limit counters: one minute, then deleted automatically.
• Signup service logs: 30 days.
• cve.bz server logs: a limited period, until they are overwritten by newer entries.
• cve.bz rate-limit counters: in memory only, and forgotten when no longer needed or when the server restarts.
• Files checked on cve.bz: not kept; they are discarded as soon as the check is answered.
• Emails you send us: as long as needed to handle your request and keep a record of it.

9. International transfers

We are based in the United States and store information in the United States. CloudFront serves pages from locations around the world, so a request may be handled outside your country. If you are outside the United States, your information will be transferred to and processed in the United States, where data protection laws may differ from yours. Where the law requires a transfer mechanism, we rely on those our providers offer, such as the European Commission’s Standard Contractual Clauses in AWS’s data processing terms.

10. Your rights and choices

• Unsubscribe at any time with the link in any update email, or by writing to us.
• Access, correction and deletion. Ask for a copy of the information we hold about you, ask us to fix it, or ask us to delete it.
• Objection and restriction. Object to processing based on our legitimate interests, or ask us to limit it.
• Portability. Ask for your signup information in a common, machine-readable format.

To use any of these rights, email privacy@flawharbor.com from the address concerned. We may need to confirm your request before acting on it, and we will answer within the time the law allows. We do not keep IP addresses in a form we can match to a person, so we may not be able to find log entries about you. If you are in the EEA or the UK, you may also complain to your local data protection authority.

11. California privacy notice

This section applies to California residents and supplements the rest of this policy, including for purposes of the California Consumer Privacy Act, as amended by the California Privacy Rights Act.

• Categories collected in the last 12 months: identifiers (email address, IP address and a keyed hash of it) and internet or network activity (requests in server logs). We collect them from you and your browser, for the purposes in section 5, and keep them as described in section 8.
• No sale or sharing. We do not sell personal information, and we do not share it for cross-context behavioral advertising. We have not done so in the last 12 months. We do not knowingly sell or share the personal information of anyone under 16.
• No sensitive personal information is collected or used.
• Disclosures for a business purpose: identifiers and network activity to our service providers (section 7).
• Your rights: to know what personal information we collect, use and disclose; to delete it; to correct it; and not to be treated differently for using these rights. Since we do not sell or share personal information, there is nothing to opt out of; browser signals such as Global Privacy Control are consistent with how we already operate.

To make a request, email privacy@flawharbor.com. We will verify your request by confirming it with the email address concerned. You may use an authorized agent; we may ask the agent for proof of your permission and ask you to confirm your identity with us.

12. Children

Our services are for security professionals and organizations, not children. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us personal information, contact us and we will delete it.

13. Security

Our sites are served only over HTTPS. The signup list is encrypted at rest and only the systems and people who need it can reach it. We store a keyed hash instead of your IP address with your signup. No system is perfectly secure, so we cannot guarantee the security of information sent over the internet, but we work to protect it and will notify you of a breach where the law requires.

14. Changes to this policy

We may update this policy as our services change. We will post the new version here and change the “Last updated” date. If a change materially affects how we use information we already hold, we will tell those affected, for example by email to the signup list, before it takes effect.