Privacy · effective November 2, 2026
Privacy
I’m Varun, and I run bounty.index on my own. This page is the honest version of what the site collects and why. No ad trackers, nothing sold, nothing shared beyond the handful of services it takes to keep the lights on.
The short version
- Browse without signing in and I collect no personal data about you, just anonymous, aggregated traffic counts.
- Sign in with GitHub and I store your GitHub name, email, and avatar so your account works across devices.
- Everything you save (watchlist, notes, filters, alerts) is yours. Delete your account and it all goes with it.
- No cookie banner, because the only cookie is the one that keeps you signed in, and the analytics are cookieless.
What I collect, and when
When you just browse
Nothing that identifies you. The site uses Vercel Web Analytics, which is cookieless and counts page views in aggregate without building a profile of you. My host (Vercel) also keeps short-lived server logs that include IP addresses, the normal plumbing every website has, used to serve pages and stop abuse.
When you sign in with GitHub
Signing in is optional and only unlocks the saved features below. When you do, GitHub shares your profile and I store your name, email, and avatar image, plus the OAuth tokens that link your account to GitHub. If the database is briefly down during sign-in, that same GitHub profile is held in a short queue so your account still gets created once service returns. I never see or store your GitHub password.
The things you save
Tied to your account: your watchlist, your compare list, saved filters, private notes on programs, and any response-time reports you submit (with the optional short comment). Private notes stay private to you. Reports are pooled into anonymous aggregates (like a median first-response time); your individual rows are not shown to other users.
Discord alerts
If you set up alerts, I store the Discord webhook URL you give me and what you want it to watch, so the cron job can post to your channel. You can delete a subscription any time and the row is gone. Delivering an alert means sending that message to Discord, which is governed by Discord’s own privacy policy.
The MCP endpoint
The public MCP endpoint is open and needs no account. For each request I log the IP address and user-agent, with no name attached, purely to count how many tools connect and to catch abuse. It is not linked to any signed-in account.
Why I hold it, and the legal basis
Account data exists to run the features you asked for: that is performance of the service you signed up for. Server logs and the MCP request log exist to keep the site up and stop abuse: that is my legitimate interest in a working, un-abused site. I do not use any of it for advertising, and I do not sell or rent it to anyone.
Who else touches it
Only the services it takes to run the site, each acting as a processor on my behalf:
- GitHub handles sign-in (OAuth).
- Neon hosts the Postgres database where your account data lives.
- Vercel hosts the site, the cookieless analytics, and the brief sign-in queue.
- Discord receives alert messages, but only for subscriptions you create.
These providers may process data in the US or the EU. That is the only sharing that happens.
Cookies
One cookie, and it is the session cookie that keeps you signed in after you log in with GitHub. It is strictly necessary for the account to work, so there is no consent banner to click through. The analytics are cookieless and store nothing on your device. If I ever add a tracker that is not strictly necessary, this section and the banner situation change, and I will say so here first.
How long I keep it
Account data stays until you delete your account, at which point every row tied to you (watchlist, notes, filters, reports, alert subscriptions) is removed with it. Server logs and the MCP request log are short-lived and kept only as long as they are useful for running and protecting the site. Public program data in the index is not personal data about you and is kept as part of the catalog.
Your choices and rights
Depending on where you live (the EU, UK, and California give explicit versions of these), you can ask to access a copy of your data, correct it, delete it, export it, or object to a particular use. The fastest route for most of it is in the app: delete a note, clear a watchlist item, remove an alert, or delete your account to wipe everything. For anything the app does not cover, email me and I will sort it out. I will never charge you for a request or make you jump through hoops to leave.
Children
This is a tool for security researchers and is not aimed at children. I don’t knowingly collect data from anyone under 16. If you believe a child has signed in, email me and I’ll remove the account.
Changes
If the site starts collecting something new, I’ll update this page and move the effective date at the top. No quiet changes to how your data is used.
Questions, or want to exercise any of the above? Email varunshukla747@gmail.com.
terms →
