Security & Privacy
Free Fairquery tools run locally, and Fairquery code stores nothing from them. Paid tools run as Apify Actors in your Apify account: for Apify Actors, Fairquery's code doesn't send your inputs or results to Fairquery, and run data follows your Apify plan's retention. For RapidAPI, a Fairquery-operated service processes each request in memory and is designed not to store inputs or results. We don't sell your inputs or results, and we don't use them to train AI models. Report vulnerabilities to fairquery@proton.me.
This page describes how the tools are designed to work today. It is not a guarantee, and it may change as the tools change. Nothing on this page creates a contractual obligation; the Terms of Service govern use of the services. No system is perfectly secure. What Fairquery itself collects as a business (support emails, purchase records, quota counters) is summarized in the Privacy Notice.
Data handling by tool
| Tool | Where it runs | What leaves your machine, and to where | What is stored |
|---|---|---|---|
Agent Trust MCP free tools: pii_scan_text, pii_redact_text and other pii_* tools, email_check_syntax, sanctions_list_sources | Your machine | Nothing. These tools are designed to make no network requests. | Nothing stored by Fairquery code. Your MCP client, AI host or operating system may keep its own logs |
Agent Trust MCP free tools: osv_query_packages, osv_get_vulnerability | Your machine | Package names, versions and vulnerability IDs go only to api.osv.dev (Google's public OSV API). | Nothing stored by Fairquery code |
Free tools in each Actor's stdio MCP server (for example check_email_syntax, list_sources) | Your machine | Nothing beyond what the tool description states. Free tools are designed not to call Apify or any Fairquery endpoint. | Nothing stored by Fairquery code |
| Fairquery OSV for VS Code | Your editor | Dependency names and versions go only to api.osv.dev. | Nothing stored by Fairquery code |
| Paid MCP tools and the Apify Actors | Your own Apify account, called with your own APIFY_TOKEN | See the per-Actor notes below. | The run's default (unnamed) storages in your Apify account, under your plan's retention |
| RapidAPI listings (email, sanctions, website) | A Fairquery-operated Apify Standby service behind RapidAPI | Your request goes through RapidAPI to the Fairquery-operated service, which processes it in memory. Otherwise the same processing as the matching Actor (see below). | Inputs and results are not written to a dataset; results are returned in the response only. Request metadata logs and a per-subscriber quota counter are kept. RapidAPI and Apify keep their own platform logs |
Paid tools on Apify
When you call a Fairquery Actor, whether directly, through Apify MCP, an n8n template, or a paid MCP tool using your APIFY_TOKEN, the run executes on the Apify platform under your account, and the run is billed to you there. Following Apify's standard model, each run gets an unnamed default key-value store (holding your INPUT and a RUN_SUMMARY of counts) and a default dataset (holding the results). Fairquery code is designed to write nothing else: it creates no named storages, keeps no copies, and sends no data to Fairquery servers. Unnamed storages are deleted automatically when the data retention period of your Apify plan expires. You can delete a run's storages earlier in Apify Console or via the API. Run logs are designed to contain progress counts and error statuses, not your input content. Apify's own privacy policy covers the platform.
- Email Validator: Sends only the domain part of each address (never the full address) to Cloudflare DNS-over-HTTPS (
cloudflare-dns.com) for MX/SPF/DMARC lookups. It sends no email and does no SMTP probing. - Sanctions & Watchlist Screener: Downloads the OFAC, EU, UK and UN lists from their official sources. The names you screen are matched in memory, and the Actor is designed not to send them to any third party.
- LLM Data Guard (PII & secrets): Processes text in memory and is designed not to log document content. By default it deletes the
INPUTrecord when the run ends (purgeInputAfterRun= true), so only the results dataset remains. The placeholder-to-original map is returned only when you setreturnPlaceholderMap. It fetchesdocumentUrlsonly if you supply them. - OSV Dependency Vulnerability Check: Sends package names and versions (parsed from your manifests or lockfiles) only to
api.osv.dev. - SEC EDGAR Company Facts & Filings: Queries the SEC's public endpoints (
data.sec.gov,www.sec.gov) for the tickers, CIKs or names you request. - Website Tech, SEO & AI-Readiness: Fetches the public pages you specify, plus
robots.txt, the sitemap andllms.txt, from those sites. - Website Contact & Company Enricher: Fetches public pages of the domains you supply and is designed to respect
robots.txt. It looks up MX records through Cloudflare DNS-over-HTTPS. It returns contact details published on those pages, which may include named business email addresses and phone numbers. Treat those as personal data where the law does.
MCP servers read APIFY_TOKEN from the environment only when a paid tool is called. They are designed not to log the token, return it, or include it in error messages. No repository or package contains credentials.
RapidAPI listings
RapidAPI forwards requests to a Fairquery-operated Apify Standby service. The service verifies RapidAPI's proxy secret, processes each request in memory and returns the result in the response. It is designed not to write inputs or results to storage. Fairquery's request logs record only the HTTP method, path (without query string), status and latency. A per-subscriber request counter is kept to enforce free-tier quotas. Apify's platform may keep its own container and request logs for the Standby service under Apify's retention, which Fairquery doesn't control. RapidAPI's own terms and privacy policy apply to its gateway.
Privacy questions and data requests
Questions about your data, or requests to access or delete it, go to fairquery@proton.me. For data stored in your own Apify account, you can delete run storages yourself in Apify Console or via the API. Platform data (Apify, RapidAPI, Gumroad) is handled under those platforms' privacy policies. See the Privacy Notice for more.
Reporting a vulnerability
- Email fairquery@proton.me with a description, affected tool and version, reproduction steps and impact. Or use Report a vulnerability (private vulnerability reporting) on the tool's GitHub repository's Security tab.
- Please don't open public issues for vulnerabilities. Keep testing to Fairquery's own code and endpoints, don't access other users' data, and don't degrade the service (see section 4 of the Terms of Service). This does not authorize testing of Apify, RapidAPI or other third-party systems.
- Response targets (targets, not commitments): acknowledgement within 3 business days, initial assessment within 7 days, and a fix or mitigation for critical issues within 30 days. We aim to coordinate disclosure with you and credit reporters who want it.
- Supported versions: the latest release of each tool (the current Apify Actor build, the latest npm and VS Code extension release, and the
mainbranch of each repository). - In scope: Fairquery's GitHub repositories, npm packages, Apify Actors and this website. Vulnerabilities in Apify, RapidAPI or other third-party platforms should go to those vendors.
Machine-readable contact: /.well-known/security.txt.