Privacy and legal notice

What happens when you check a package.json

The file is read in your browser. Only package names and version numbers go to our server, which looks them up at the npm registry, GitHub and OSV.dev. The file itself, and any lockfile, never leaves your browser.

There are no accounts, no cookies, no analytics and no advertising. We don’t build profiles and don’t sell data.

Hosting and server logs

The site runs on Vercel (Vercel Inc., USA). Like any web server, Vercel records technical data for each request, such as your IP address, the time and the requested page, to deliver the site and keep it secure. These logs are deleted after a short period. Lookups from npm, GitHub and OSV.dev are cached for a few hours; the cache holds package data only, nothing about you.

GitHub

Package logos are loaded by your browser from GitHub (avatars.githubusercontent.com). When you load a repository from GitHub, your browser asks GitHub’s API (api.github.com) which package.json files the repository contains and then reads them, together with any lockfile, from raw.githubusercontent.com or the API. In all these cases GitHub (GitHub Inc., USA, part of Microsoft) receives your IP address and the repository you load.

Release notes, changelogs and whether a repository is archived are fetched by our server with its own GitHub access. Those requests contain package and repository names only, nothing about you.

Accounts (optional)

You can use the site without an account. Signing in with GitHub is optional and only covers public repositories: the login asks GitHub for no access beyond your public profile and read access to your email addresses, which GitHub shows on its authorization screen.

Your account is kept by Supabase (Supabase Inc., USA): your GitHub user ID, username, name, email address and avatar, the repositories and folders you choose to track, and the counts from their last check (no source code). Your login session is kept in your browser’s local storage.

The access token GitHub issues at login stays in your browser. It is used there to list your public repositories, find their package.json files and read them together with their lockfiles. It is not stored on our side. You can also revoke it at any time in your GitHub settings under Applications.

You can delete your account at any time on the “Your repos” page. That removes the account and everything tracked with it.

Shared links

A share link contains the dependency list itself, in the part after #. Browsers never send that part to a server, so nothing is stored on our side. Anyone who has the link can see the list, so share it only with people who may see it.

Stored in your browser

Your choice of package manager for the update commands is saved in your browser’s local storage so it is remembered next time. It never leaves your device; clearing your browser data removes it.

Transfers abroad

Vercel, GitHub and Supabase are US companies, so data mentioned above may be processed in the USA. Each provider describes in its privacy policy how it protects data transferred from Switzerland and the EU.

Your rights

Under the Swiss Federal Act on Data Protection you can ask what data about you is processed, and have it corrected or deleted. Write to the address above. You can also contact the Federal Data Protection and Information Commissioner (FDPIC).

No warranty

Version data, advisories and release notes come from npm, GitHub, OSV.dev and the projects themselves. They can be incomplete, out of date or wrong, and release notes are shown as their authors wrote them. Check before you rely on them; this site gives no warranty and accepts no liability for decisions based on it.