Privacy
Who runs Hajes
Hajes is operated from the Kingdom of Saudi Arabia. The operator’s legal name and address will be stated here before the preview opens beyond invited teams.
What Hajes stores
Your account: the email address you sign in with and the name you give. Your team: its name, its members and the invitations it sent. Your domains: the host names you add, the verification token for each, when it was last checked and whether it passed, and the subdomains discovered under it. Your scans: when they ran, who asked for them, their findings and summaries. An audit log of who did what and when: signing in, adding or removing a domain, asking for a scan. The alert emails sent to you.
What a scan touches
Only hosts under a domain your team has proven, from Hajes’s own servers, at a polite rate. Discovery asks public services about your domain name and nothing else: certificate transparency logs (crt.sh) and public DNS resolvers over DNS-over-HTTPS (Cloudflare, Google). Vulnerability lookups go to NVD and OSV with product names and versions, never with your domain.
Where it runs
The backend and the database run on Convex. Sign-in codes, invitations and alert emails are sent through Resend, which receives the address and the message, nothing else. Both are providers with their own terms, and they process data in the regions they operate in, which may be outside Saudi Arabia.
Who sees the results
Scan results are private to your team: its members, and no one else. The operator can reach stored data to run the service, answer a request from you or investigate abuse, and does not browse it otherwise.
Cookies and your browser
One cookie, hajes_in, says that a browser has signed in, so the front door shows the app instead of this site. It holds no secret. Your theme choice stays in your browser. The sign-in session itself is kept by the authentication system. There are no analytics, no advertising, no third-party scripts and no external fonts on any page.
Keeping and deleting
Removing a domain removes its subdomains, scans and findings. To close an account or a team, write to the address below. Audit entries may be kept where they are needed to investigate abuse.
Contact
Questions about this page, or a request about your data: [contact address to be added]