pkgprobe is a local-first security tool. Your dependency scans run on your own machine, and the overwhelming majority of what pkgprobe processes never leaves it. This policy explains the narrow set of data we do handle, why, and where it goes.
1. Data the app processes locally
When you scan, pkgprobe reads your projects and their dependencies on your
device and stores results in a local cache under ~/.pkgprobe/.
This scan data — file paths, dependency names and versions, source code —
stays on your machine. We never receive it.
The one exception is vulnerability lookups: to check for known CVEs,
pkgprobe sends package coordinates (a package URL such as
pkg:npm/lodash@4.17.21) to the pkgprobe vulnerability proxy,
which queries OSV on your behalf and caches the result. Only the coordinate
is sent — never file paths, project names, or code.
2. Telemetry is opt-in
Telemetry is off by default. Nothing is emitted until you explicitly enable crash reports and/or analytics in Settings, and you can turn it off again at any time.
The following are never emitted, by any code path:
- File paths or directory names
- Dependency names, versions, or package coordinates
- Source code or local variable contents beyond inspected crash frames
- Your IP address (the crash/analytics SDK runs with PII sending disabled)
- Registry credentials, license keys, or any secret
When enabled, analytics is limited to a fixed allowlist of product events
(for example, "a scan completed" or "the dependency graph was opened") with
only generic properties — language identifiers like "rust",
never strings drawn from your data. Crash reports carry stack traces that
are inspected for personal data before they are sent. Telemetry is delivered
to pkgprobe-operated, self-hosted infrastructure — not a
third-party analytics SaaS.
3. Account, licensing & payment data
To sell and license the software, we process:
- Email address — to start a trial, issue a license, and send transactional messages. One trial per email is enforced.
- Machine activation data — a machine fingerprint is used to bind paid seats to devices and enforce seat counts.
- Payment information — handled by our payment processor, Lemon Squeezy, acting as Merchant of Record. We do not store card numbers; we receive order and subscription status to provision entitlements.
4. The website
This marketing site is static. It sets no tracking or advertising cookies. Standard server logs may record request metadata transiently for security and reliability. The site currently loads web fonts from Google Fonts, which means your browser requests those font files from Google; we are evaluating self-hosting to remove that third-party request.
5. Where your data goes
- Vulnerability proxy — package coordinates, for CVE lookups (pkgprobe-operated).
- License service — email + activation data (pkgprobe-operated).
- Self-hosted Sentry — opt-in crash/analytics events (pkgprobe-operated).
- Lemon Squeezy — payment processing (their privacy policy applies).
6. Your choices & rights
You can run pkgprobe with telemetry disabled entirely (the default). You may request access to, correction of, or deletion of the account data we hold (email, activation records) by contacting us. Because telemetry is self-hosted and pseudonymous, retention follows our infrastructure's configured window; there is no per-event deletion flow once events are emitted.
7. Contact
Privacy questions or data requests: privacy@pkgprobe.dev.
This draft describes current engineering behaviour and is provided for transparency. It is not yet a binding privacy policy and will be finalised with counsel before launch.