How we handle data
Short and honest. If something here is unclear, write to us through the design partner form.
The free check
- Your package.json is analysed in your browser. It is not uploaded and we do not store it.
- "Share this report" puts your package.json, compressed, into the link itself (after the
#). Browsers do not send that part to the server. Anyone who has the link can read it, so share it only with people you trust.
Analytics (PostHog, EU)
- No cookies and no local storage: analytics state lives in page memory and is gone when you close the tab.
- We record page views and four events: tool opened, scan submitted (only the number of upgrades found, the number skipped and whether Node.js is end-of-life), share clicked, partner form submitted. Never package names or file contents. The part of the address after
#is removed before sending. - PostHog receives your IP address and browser details as part of any web request.
Error reports (Sentry, EU)
- If the page crashes, the error and a stack trace are sent so we can fix it — without user info, cookies, local variable values or the contents of your package.json. The part of the address after
#is removed.
Your theme choice
- If you switch to the dark theme, that choice is saved in your browser's local storage under the key
theme. It never leaves your browser.
Design partner form
- Your e-mail, repo link and message are sent to us as an e-mail (via Resend). There is no database: the message stays in our mailbox for as long as we talk to you.
Upgrade jobs
- For a job we clone your repository with a read-only token limited to that one repo, valid for one hour, into an isolated sandbox. The sandbox exists for the duration of the job; the session is deleted afterwards.
- Job logs are kept for 30 days, then deleted.
- The pull request in your repo is opened by our backend, never from the sandbox. We never auto-merge.
- Your code is processed by an AI model through Anthropic's API (the agent and the L2 review) under their commercial terms.
Providers
| Provider | What for | Data | Region |
|---|---|---|---|
| Cloudflare | Hosting of this site and the form endpoint | Web requests (IP address, browser) | Global network |
| PostHog | Cookieless analytics | Page views, 4 events with counts | EU Cloud |
| Sentry | Error reports | Error and stack trace, no user info | EU region |
| Resend | Delivers the design partner form to our mailbox | E-mail, repo link, message | Outside the EU |
| GitHub | Cloning your repo and opening the pull request | Your repository (jobs only) | Outside the EU |
| Anthropic | AI model for upgrade jobs (not used by the free check) | Your code during a job | Outside the EU |
Some of these providers process data outside the EU (for example Cloudflare's global network and Resend). We do not claim that every trace is deleted everywhere; we keep what we control to the minimum described above.