Privacy
What we collect, and what we do with it
No cookies, analytics, or third-party requests. We receive only what you email us or share for research.
This website
No tracking on this site
The site has no forms, analytics, or third-party requests.
We set no cookies or local storage. Fonts and scripts come from this domain; our content security policy blocks third-party content.
The assistant uses fixed answers and makes no requests. Your messages stay in the browser and disappear when you close the page.
Contact links open your email client. This site sends no form data.
Cloudflare logs IP address, time, URL, and user agent for delivery and abuse prevention under its retention policy. We do not build visitor profiles.
Enquiries
When you email us
We receive the details you choose to send.
We use your email to reply, assess the fit, and scope or quote work. We do not add you to marketing lists.
Mail stays with our email provider and on our machines. We delete enquiries that do not become work within twelve months, or sooner on request after the conversation ends.
Ask for an NDA before sharing sensitive details if needed.
Engagements
Research data is the part that matters
What we keep during research, and for how long.
-
What we are given
Source, binaries, environments, documentation, and credentials needed for the agreed work. We treat them as confidential.
-
What we produce
Crash inputs, harnesses, notes, analysis, and proofs. We redact user data from captured material where possible.
-
If we encounter real user data
We stop, record the event, and retain none of the data.
-
Where it is kept
On encrypted disks, accessible only to the researchers. Findings go only to your named contacts.
-
How long it is kept
We destroy credentials when work ends and ask you to revoke them. We delete research material after twelve months unless your contract or NDA sets another period.
-
What we do not do with it
We publish nothing from your engagement without written permission, including anonymised material. We do not use it for training or sell it.
-
Where a finding is in somebody else's software
We report third-party flaws to the vendor under our disclosure policy, without naming you or your systems.
Third-party targets require the owner's written authorisation before work starts.
Sharing
Who else sees any of it
We sell neither data nor findings. Research is done in house without subcontractors. Our disclosure policy covers third-party flaws.
Our email, hosting, and report-tool providers process data to provide their services. Findings and research material stay on our machines; nothing you email passes through this site.
We disclose material if legally required and tell you unless prohibited.
Your rights
Asking what we hold
Email us to access, correct, or delete your data.
Where applicable law grants rights to access, correction, erasure, restriction, portability, or objection, email contact@skullsploit.com. We respond within thirty days.
Contract or NDA retention terms may limit deletion; we will explain when they apply.
Skull Solutions Pvt Ltd, a company registered in the Maldives, is the data controller.
Changes
If this policy changes
Changes apply to future work, not existing engagements. The date above marks the last change.
Questions go to contact@skullsploit.com.