Privacy

Cookies and analytics

We don't use analytics or advertising trackers. No account or sign-in cookies are needed.

Hosting and logs

Cloudflare hosts the site and processes your IP address to serve requests and protect its network. Default request logs are disabled.

We use diagnostic logs and traces to investigate errors. These can include public package names, compared versions, timings and IDs that link related operations.

Browser diagnostics report errors automatically. Browser and server error records include the error type, source and code location, but not error messages, URLs, function names or local file paths.

Diagnostics exclude your IP address, credentials, AI prompts, package file contents, evidence packets and provider responses.

Abuse prevention

We use a temporary hash of your IP address for Cloudflare rate limits, including limits on new AI notes. Hashing does not make it anonymous. People on the same network share these limits.

This key stays out of saved jobs, package evidence, AI requests and diagnostic logs. We don't create visitor accounts or profiles for rate limiting.

Package data and AI

We fetch public package data from npm, GitHub, OSV and Bundlephobia, and save data and AI notes for reuse. Saved archive inspections and AI notes don't expire automatically.

When we detect source data changes, we refresh the result the next time it's requested.

AI providers receive comparison data and public release notes to generate AI notes. These may include contributor names or handles.

Your rights

You can ask what data we use or clear cookies and site data in your browser.

We don't require accounts or track visitors, so there's usually no visitor profile to delete or export.

Contact us

For questions about privacy, open an issue on our GitLab repository.

Changes

We'll publish changes here with an updated revision date.