Privacy
noticely/deps keeps as little as it can, for as short as it can. This page lists everything that is stored, why, and for how long.
Reports
- What is stored
- Only the dependency names, version ranges and resolved versions from your file, and the resulting report. Never the whole file, scripts or other fields.
- Who can see it
- Anyone with the report link, which contains a long random id. Package names are sent to the public npm registry, OSV.dev and deps.dev to look them up.
- How long
- Deleted automatically after 30 days.
Email lists
- What is stored
- Your email address and the list you joined (PDF report or check packs).
- Confirmation
- Unconfirmed addresses are deleted after 7 days. Once you confirm, the address is used only for that one announcement.
- Unsubscribing
- Every email has an unsubscribe link. Unsubscribed addresses are deleted after 30 days.
Contact form
- What is stored
- Your name, email, optional company and message, used only to reply to you.
- How long
- Up to 180 days.
Abuse protection
- IP address
- Stored only as a keyed hash to enforce the daily check limit, and deleted after 48 hours.
- Bot check
- Cloudflare Turnstile runs on the forms to block bots. See Cloudflare's Turnstile privacy addendum.
Your data, your call
To ask what is stored about you or to have it deleted earlier, send a privacy request. It is answered within 30 days, usually much sooner.
Last updated 13 October 2026.