Disclaimer and your data

Disclaimer

Verdicts are computed, and can be wrong

Every verdict is derived from public signals — registry metadata, the repository's commits, issues, releases and README, and the project's own lifecycle pages — by rules that are described on the front page. Nobody at the project is asked. A maintainer on holiday looks like a project coasting; a finished library looks like an abandoned one until you read why it stopped changing.

Treat a verdict as a reason to look, not as a conclusion. It is not security advice, not legal advice, and not a statement about the people who maintain a package. The supply-chain history on a package page is collected from public incident reports and vendor write-ups; it records what was published, not a judgement of the project, and a package with no incidents listed is not thereby safe.

The site is offered as it is, without warranty of any kind. If a verdict is wrong about a package you know, write to [email protected] and it will be corrected.

Reading the site

Without an account, we keep nothing about you

• Public pages set no cookie and load no tracker. On the main domain only, a cookieless page-view counter may run; it stores no identifier and there is nothing to consent to. On every other host it is absent.
• A pasted manifest is read for its package names and version specifiers, and only those are kept, in a report that expires after 30 days. The file itself is never stored.
• Request logs are kept for 30 days for debugging and to enforce rate limits, then pruned.

With an account

What we store, and why

• Your email address. It is the account. It is used to sign you in by magic link and to send the alerts and digests you asked for, and for nothing else.
• Sign-in tokens. Stored hashed, usable once, and dead after 15 minutes. A session cookie, strictly necessary, keeps you signed in for 30 days.
• What you watch. Project names and the packages in them. Nothing about the rest of your code.
• Delivery channels. The Slack or Discord webhook URLs you add, so alerts can be posted there.
• Billing. If you subscribe, Stripe holds the card and we hold only the customer and subscription identifiers. We never see the card.
• Alerts sent. A record of which alerts went to which address, so the same one is not sent twice.

You can stop watching any package, delete any project, or delete the whole account from your dashboard. Deleting the account removes the address, sessions, projects, watches, channels and alert history in one transaction. It is not recoverable.

Who else sees it

Three services, each for one thing

• Resend delivers email. It sees the address and the message.
• Stripe handles payment. It sees what a payment processor sees.
• Anthropic may be asked to summarise a package's public signals in plain words. It is sent public repository data, never anything about an account.

The crawler talks to npm, PyPI, crates.io, pkg.go.dev, GitHub and the lifecycle sources on its own behalf. No user data goes with those requests. Nothing is sold, shared for advertising, or used to train anything.

Where and how long

Hosting and retention

The site and its database run on a server hosted by OVH in Beauharnois, Canada, with an encrypted nightly backup kept in a different region. Canada holds a European Union adequacy decision, so data of readers in the EU is handled under that.

• Sign-in tokens: 15 minutes.
• Sessions: 30 days.
• Shared reports: 30 days.
• Request and job logs: 30 days.
• Cached registry and repository responses: 60 days.
• Account data: until you delete the account.

Questions

Anything here you want explained, exported or removed: [email protected].