Privacy Policy

Raven is designed to handle your system prompt with the minimum data exposure necessary. This page explains exactly what is collected, what is sent where, and when it is deleted.

Your system prompt

The system prompt you paste into Raven is sent over HTTPS to the Raven backend server solely to run the vulnerability scan. It is held in memory for the duration of the scan request, typically 10 to 30 seconds. It is not written to disk, not stored in a database, not logged, and not retained after the HTTP response is sent. Once the scan result is returned to your browser, the prompt is gone from the server.

What is sent to third-party services

Running a scan requires sending your system prompt and each attack payload to an AI inference service to generate responses. Raven uses third-party AI infrastructure for this. Your system prompt is included in each of the 25 scan requests, one per attack. These requests are made server-side. The inference service processes the data under its own terms of service. Raven does not control how the inference provider handles data after the response is returned.

Cookies

Raven sets one cookie: raven_uid. This is a random unique identifier. It is used solely for rate limiting so that scan limits apply fairly per browser session rather than per IP address, which would be unfair on shared networks. The cookie is HTTP-only, cannot be read by JavaScript, expires after 24 hours, and contains no personally identifiable information.

Server logs

The Raven backend logs basic request metadata for operational purposes: HTTP method, path, response status code, and elapsed time. System prompt content is never included in logs. The first 8 characters of API keys are logged at startup to confirm configuration. Full keys are never logged.

Analytics and tracking

Raven does not use any third-party analytics, tracking pixels, session recording, or advertising scripts. There is no Google Analytics, no Mixpanel, no Hotjar, and no equivalent on this site.

Data retention

There is nothing to retain. Raven has no user accounts, no database of scan history, and no stored prompt content. Each scan is stateless. When your browser tab closes, the scan results exist only in your browser's memory until you navigate away.

Your rights

Because no personal data is stored, there is no data to access, correct, or delete. If you have questions about data handling, contact Javeria Akram via LinkedIn.

Changes to this policy

If this policy changes materially, the updated version will be posted at this URL with a revised date at the top of the page.

Last updated: August 2026.