Privacy Policy

Account information

When you register with an email and password, we collect:

• Display name
• Email address
• Password (stored as a one-way hashed value. We never store your plain-text password)

GitHub OAuth data

When you sign in or link your account via GitHub, we receive and store:

• GitHub user ID and username
• Email address provided by GitHub
• OAuth access token (used to access repositories on your behalf)
• Organization memberships (admin-only, for organization setup)

Requested OAuth scopes: read:user, user:email, read:org

Google Sign-In data

When you sign in or sign up with Google, we receive and store:

• Google account ID (the sub claim, a stable identifier that is never your email)
• Email address and whether Google has verified it
• Display name
• Profile picture URL

No Google access token is requested or stored. Deptools only verifies the identity token Google issues at sign-in, which requires no token of its own, and never gains access to any other Google service such as Gmail, Drive or Calendar.

Requested scopes: openid, email, profile. Signing in with Google does not connect a GitHub account; you can connect one later from your settings.

GitHub App data (Pro plan)

Pro plan users connect their GitHub organization via our GitHub App, which grants Deptools access to private repositories. The GitHub App requests the following permissions:

• Repository contents: read • to read dependency manifest files (e.g. package.json, pom.xml, build.gradle, etc.)
• Repository metadata: read • to access repository name, visibility, and default branch
• Organization members: read • to verify organization membership during setup

We do not access source code beyond dependency manifest files. GitHub App access can be revoked at any time from your GitHub organization settings.

Repository and analysis data

To provide our dependency analysis service, we access and store:

• Repository metadata: name, owner, default branch, visibility (public or private)
• Dependency manifest files (e.g. package.json, pom.xml, build.gradle, etc.)
• Computed dependency graphs and security scores
• Vulnerability data from OSV (Open Source Vulnerabilities), which aggregates the National Vulnerability Database (NVD) and the ecosystem advisory feeds, including GitHub Security Advisories
• Scan logs: user ID, organization, repository identifier, and timestamp of each analysis

Analysis results are stored as JSON files on our OVH server in Gravelines, France. We do not access your source code beyond the dependency manifest files required to perform the analysis.

The visibility of a project on Deptools mirrors its visibility on GitHub: analysis dashboards for public GitHub repositories are accessible without authentication to any visitor of deptools.io. Private repositories are never exposed publicly.

API keys and uploaded manifests

Projects that are not hosted on GitHub can be analyzed by sending their dependency manifest files to our public API, authenticated with an API key created from your organization or project settings. For this feature we store:

• API keys, as a one-way hash together with their label, scope and last-used date. The plain key is shown once at creation and is never stored
• The dependency manifest files you upload, processed and stored exactly like manifests read from GitHub

API keys can be revoked at any time from your settings, which stops every request made with them immediately.

Demo analyses

We run one-off analyses of public open source repositories, without an account, to demonstrate the service. They only involve public repository data, hold no personal data, and are deleted automatically 16 days after they are produced.

Billing and subscription data

Payment processing and invoicing are handled entirely by Lemon Squeezy, which acts as the merchant of record. We do not store your credit card information and we do not manage invoices. We only store the minimum subscription metadata needed to determine your plan access:

• Lemon Squeezy customer ID and subscription ID
• Subscription plan, status, and renewal dates
• Trial usage flag

For invoices, payment history, and billing records, please refer directly to your Lemon Squeezy customer portal.

Technical data

Our server and application may generate standard technical logs including:

• Application-level logs (errors, warnings) for debugging purposes
• GitHub and Lemon Squeezy webhook event logs
• Your IP address, recorded in standard server access logs and used as a counter key to enforce rate limits on authentication and API endpoints, which protects your account against brute-force attempts. It is never linked to your account for analytics or profiling, and it follows the log retention period stated below

Product analytics data

We use PostHog (EU region) to collect product analytics data to understand how the service is used and improve it. This includes:

• Page views and navigation patterns
• Feature usage events (e.g. project created, analysis launched, dashboard viewed)
• A numeric user identifier (user.id) used as the PostHog distinct_id for authenticated users

Our public documentation at deptools.io/docs uses the same PostHog project with the same configuration. Its events are tagged site: 'docs' and cover page views and exits, clicks on links back to the application and on external links, use of the copy button on code blocks, documentation searches, and requests for a page that does not exist. Only the search event records free-form text: the term you type is stored in lowercase.

Both sites are served from the same origin, so they share the same localStorage and therefore the same PostHog distinct_id. Once you are signed in to the application, the documentation pages you read are attached to the same profile as your activity in the app.

On both sites, PostHog is configured in cookieless mode (persistence: 'localStorage'), with IP address collection disabled and autocapture disabled. Data is stored on PostHog EU infrastructure (eu.i.posthog.com). Your email address is never included in analytics event properties.