Pricing

One scan is one run against one URL, across all the device profiles you've selected. The scan submits a safe form (newsletter/search) and clicks up to 2 main CTAs per device — so you catch post-click bugs like broken signup modals and video players, not just the landing page. On Pro and above, a single scan can also crawl multiple pages (2 on Pro, 4 on Studio).

No SDK, no snippet, no Chrome extension. Canaryflux crawls your site externally — exactly like a real visitor would. Paste a URL, pick your devices, click run.

We render your site at the actual viewport, device-scale, and user-agent of each target device — iPhone 15 Pro, Pixel 8, Galaxy S25 Ultra, iPad Pro, Desktop Chrome and so on. This is high-fidelity device emulation, not physical hardware. Bugs we surface should reproduce on devices matching those profiles.

Each capture goes to a vision-capable LLM with a tightly-tuned QA prompt. The model lists candidate bugs from what's visible in the screenshot plus the console signals we captured. A second verification pass re-grades each finding for confidence so you don't drown in noise. Most scans produce 3–8 findings on real production sites.

Yes. Cancel from your dashboard's billing page in two clicks — handled through Stripe. Your paid tier stays active until the end of the current billing period. First-time paid subscribers can get a full refund within 14 days if they've run fewer than 20 paid scans. Scans from the free tier don't count. The refund is available once, on your first paid plan only — if you've ever had any paid plan, you're not eligible on future plans. Full details.

Yes, on Pro and Studio. Paste the session cookie or Authorization header from your browser DevTools into a project (Project menu → Authenticated scan), and every scan in that project will run while logged in. Caveat: SSO, MFA, and per-request CSRF tokens still defeat it — it works best for cookie-session apps. Free and Solo are public-pages-only.

Upgrades take effect instantly and are prorated. Downgrades take effect at the end of your current billing cycle so you don't lose paid time. Quotas reset on the first of each month.

At the workspace level, yes — findings, screenshots, and console output are only readable by your workspace through the auth-gated dashboard. Other Canaryflux customers can't see them. Behind the scenes, screenshots are processed by Google (Gemini API) on the primary path and Anthropic on the fallback path under each provider's commercial API terms (no training on inputs) and stored on our Railway infrastructure for your plan's retention window (7 / 30 / 90 / 365 days), then automatically purged on our daily sweep. A small number of Canaryflux engineers can access stored screenshots when strictly needed for support tickets you open or abuse-of-service investigations; access is logged. On Pro and Studio authenticated scans, captures include whatever your logged-in session can see — treat them as sensitive. Shareable links use 24-byte cryptographically random tokens (server stores only their SHA-256 hash) with a 90-day expiry — only people you send the URL to can open them. See our Privacy Policy and the sub-processor list.