Disclaimer and your data

Disclaimer

Verdicts are computed, and can be wrong

Every verdict is derived from public signals — registry metadata, the repository's commits, issues, releases and README, and the project's own lifecycle pages — by rules that are described on the front page. Nobody at the project is asked. A maintainer on holiday looks like a project coasting; a finished library looks like an abandoned one until you read why it stopped changing.

Treat a verdict as a reason to look, not as a conclusion. It is not security advice, not legal advice, and not a statement about the people who maintain a package. The supply-chain history on a package page is collected from public incident reports and vendor write-ups; it records what was published, not a judgement of the project, and a package with no incidents listed is not thereby safe.

These limits apply to Free and paid use. Assessments, news leads, alternatives and migration guidance are automated decision-support information, not professional advice or a guarantee of security, licence compliance, compatibility or continued support. Sources can be incomplete, delayed or wrong. Monitoring and delivery are not an emergency service or a promise to detect every change immediately. Check original sources and validate changes with your own tests and backups before relying on a result. Unconfirmed news leads are not findings that a package is malicious.

We remain responsible for the service we agree to provide. Nothing in this disclaimer excludes mandatory consumer rights or liability that the law does not allow us to exclude. If a verdict is wrong about a package you know, write to hello@isitdeadyet.dev with the supporting evidence. We review reports and correct confirmed errors.

Reading the site

Reading without an account

• On public, indexable pages, Analytiics measures visits and outbound link clicks. Its script sends the page URL, referrer, event time and a session identifier to in.analytiics.co. It stores the identifier in browser session storage, renewed after 30 minutes of inactivity; it does not use cookies. Requests also expose the visitor's network address to that service. The script is excluded from private, account, admin and sign-in pages, and from pages with query strings. We do not call its identify function or send account emails with browser events.
• A pasted manifest is read for its package names and version specifiers, and only those are kept, in a report that expires after 30 days. The file itself is never stored.
• Request logs are kept for 30 days for debugging and to enforce rate limits, then pruned.

With an account

What we store, and why

• Signup protection. We keep a keyed hash of the network used for a verified sign-in and associate it with your account for up to 30 days. IPv6 addresses are grouped by /64. This helps limit bulk account creation and identify patterns for review; a shared network is not proof of abuse. We do not store the raw IP address in these records. Anonymous signup-count records remain for up to 30 days after account deletion to prevent repeated deletion and re-signup from bypassing the limit.
• Your email address. It is the account. It is used to sign you in by magic link and to send the alerts and digests you asked for, and for nothing else.
• Sign-in tokens. Stored hashed, usable once, and dead after 15 minutes. A session cookie, strictly necessary, keeps you signed in for 30 days.
• What you watch. Project names and the packages in them. Nothing about the rest of your code.
• Delivery channels. The Slack or Discord webhook URLs you add, so alerts can be posted there.
• Billing. If you subscribe, Stripe holds the card and we hold only the customer and subscription identifiers. We never see the card.
• Alerts sent. A record of which alerts went to which address, so the same one is not sent twice.

You can stop watching any package, delete any project, or delete the whole account from your dashboard. Deleting the account removes the address, sessions, projects, watches, channels and alert history in one transaction. It is not recoverable.

Who else sees it

Services we use

• Analytiics receives the public-page analytics described above. This is separate from our own aggregate route counts retained for 30 days.
• Resend delivers email. It sees the address and the message.
• Stripe handles payment. It sees what a payment processor sees.
• Anthropic may be asked to summarise a package's public signals in plain words. It is sent public repository data, never anything about an account.

The crawler talks to npm, PyPI, crates.io, pkg.go.dev, Maven Central, NuGet, RubyGems, GitHub and the lifecycle sources on its own behalf. No user data goes with those requests. Nothing is sold, shared for advertising, or used to train anything.

Where and how long

Hosting and retention

The site and its database run on a server hosted by OVH in Beauharnois, Canada, with an encrypted nightly backup kept in a different region. Canada holds a European Union adequacy decision, so data of readers in the EU is handled under that.

• Sign-in tokens: 15 minutes.
• Sessions: 30 days.
• Shared reports: 30 days.
• Request and job logs: 30 days.
• Aggregate public page-view counts: 30 days. These store only the UTC date, route template and count, without visitor identities, IP addresses or search terms.
• Cached registry and repository responses: 60 days.
• Account data: until you delete the account.

Questions

Anything here you want explained, exported or removed: hello@isitdeadyet.dev.