Privacy Policy

Last updated November 6, 2026

SecureQuest is based in Saskatchewan, Canada, and handles personal information under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). This policy covers the SecureQuest VS Code extension and this website. In short, your code is scanned on your machine, the extension has no analytics or tracking, and data only leaves your machine in the cases listed below. The one thing we track is how many times the extension is downloaded from this site.

Stored on your machine

The extension keeps these in VS Code's local storage. We can't see them.

XP, level, badges, quests, and completed missions
How many free suggestions you've used today
Your theme, your custom quests, and whether you've agreed to AI data sharing
Your Pro license key and when it was last checked

The command SecureQuest: Reset XP clears your progress. SecureQuest also reads an optional .securequest.json team rules file from your workspace, and that stays on your machine too.

Sent to Gumroad

When you activate Pro, and about once a day after that, the extension sends your license key and the product ID to Gumroad to check that your subscription is active. Free users don't make this request.

Gumroad handles checkout and payment. We don't receive your full card details. Gumroad shares order details with us, such as your email address and what you bought, and we use them to provide support and manage your license. See Gumroad's privacy policy.

Sent to your AI provider

This only happens if you use a Pro AI feature. The flagged code and up to three lines on either side go to the language model provider you've set up in VS Code, such as GitHub Copilot. It goes directly through VS Code and never to our servers.

SecureQuest asks for your permission before the first request. It removes values that look like secrets first, but this is best effort and can miss some, so don't rely on it alone. Your provider's privacy policy applies to what it receives.

This website

This site uses no cookies or third-party scripts, and its fonts and images are served from this site. If you change the accessibility options, your choices are saved in your browser's local storage and are never sent anywhere. The site is hosted by Cloudflare, which may keep standard request logs, such as IP addresses and pages requested, under Cloudflare's privacy policy. Links to Gumroad take you to a site with its own policy.

Where data is stored

Gumroad and Cloudflare may store and process information outside Canada, including in the United States, where it may be accessible to authorities under local law.

Download counts

Each time the extension is downloaded from this site, our server adds one to a count for that day. We use this to see how often SecureQuest is downloaded. The count holds only the date and the number, so it doesn't include your IP address or anything else that identifies you, and it can't be traced back to you. Nothing is tracked after the download.

What we don't do

We don't collect your source code or scan results.
We don't sell personal information or use it for advertising.

Keeping and deleting data

We keep order details as long as we need them to support your license and meet legal and tax requirements. Download counts aren't linked to anyone, so we keep them indefinitely. Under PIPEDA, you have the right to access the personal information we hold about you and to have it corrected, and you can ask us to delete it when we no longer need it. To make a request, email support@securequest.dev. We'll reply within 30 days. If you're not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada.

Children

SecureQuest isn't aimed at children under 13, and we don't knowingly collect their personal information.

Changes

If this policy changes, we'll update the date at the top.

Contact

Questions? Email support@securequest.dev.