Privacy Policy

This policy says what PackageTrack stores and why. The short version: we store what the service needs to work, we do not sell data, and we do not run third-party trackers.

What we store for an account

Your email address, a hash of your password (argon2id; we never store the password itself), your timezone if your browser provides one, and the API keys you create.

What we store for your projects

Package names, versions, and dependency relationships from the lists you send us. When you upload a lock file, we parse it and discard the file itself; the raw file is never stored. We never receive your code.

Emails

If you have projects or watched packages, we send a weekly digest. Every mail contains a one-click unsubscribe link. We log which digests were sent to make the service reliable. We use Resend as our email delivery provider; they process your email address to deliver mail.

Operational data

Our servers keep standard access logs (IP address, requested page, time) for security and debugging, retained briefly. We also record when your account was last active and keep simple usage counters (such as page views and sign-ups) to understand whether the service works; these are aggregate numbers, not browsing profiles. Traffic passes through Cloudflare, which processes IP addresses to protect the site. We host on Hetzner servers in Germany.

Cookies

One session cookie when you log in, HttpOnly, used only to keep you signed in. No advertising or analytics cookies, no third-party trackers.

Public data

Package pages show information about open source packages (versions, changelogs, repository links) collected from public sources. This is not personal data about you.

Your rights

You can ask for a copy of your data, correct it, or delete your account and everything attached to it by emailing [email protected]. Deletion is permanent; project data attached to a deleted account is removed.

Changes to this policy will be announced by email to account holders.

Contact: [email protected]