Privacy

The controller of the personal data described below is YalsTech, a business based at 7/68-46-1, Plot No 90, Sivasakthi Gardens Phase -3, Keeranatham, Coimbatore, Tamil Nadu - 641035, India. YalsTech is a trading name rather than a registered company, so the controller is Shenbagapriya Bakthavachalam personally. Write to privacy@libyears.com about anything on this page.

We have not appointed a representative in the EU or the UK under Article 27. If you are an EU or UK customer and need one named before you can approve this product, say so and we will appoint one rather than argue about whether we have to.

There are three pieces, and this is all of them.

• Your email address, because an account needs one and because the weekly digest goes somewhere.
• Your GitHub user id and login, recorded when you install the app, so we know who authorised the installation.
• Email addresses you add for client notifications, which receive a weekly digest covering only that client's repositories, and nothing else. They grant no access to the product.

We do not ask for your name, your address, your phone number, or your job title. We do not collect commit authorship, so we never learn who wrote what.

Where the GDPR or UK GDPR applies, the lawful basis for the email address, the GitHub identifier and the repository data is performance of a contract: without them there is no account to sign into and nothing to scan. Notification addresses you add for a client rest on our legitimate interest in delivering the report you asked us to send, balanced against a recipient who can be removed by you at any time and receives nothing else.

Security logging and the audit record rest on the same legitimate interest in running the service safely. We do not rely on consent for anything, which is why there is no consent banner to click past, and we do no profiling and take no automated decision that produces a legal effect for anyone.

No session recording, no advertising or tracking pixels, no cookie banner because there is nothing to consent to beyond the session cookie that keeps you signed in. The one measurement is Vercel Web Analytics: a page-view count served from our own domain, with no cookie, no identifier that persists between visits, and no cross-site tracking; it tells us which pages are read, not who read them. The dashboard loads no script from any other origin.

Nothing is sent to any AI model. No customer data is used to train anything, ours or anyone else’s, and we do not sell or share data with anyone outside the subprocessors who operate the service.

We read manifests and lockfiles, and store the dependency inventory they describe. We do not read, store or transmit your source code. The complete list of paths we will ever fetch is on the security page, generated from the allowlist the scanner actually uses.

Private package names never leave the system. Anything published to a private registry, resolved from a scope with its own registry, or defined inside your own workspace is counted and never named to any third party — not to the npm registry, not to an advisory database, and not in a client report or an export.

Credentials found in .npmrc, .yarnrc.yml or bunfig.toml are discarded before parsing. They are never stored or logged. If we find one we say so, because a token committed to a repository should be rotated whatever we do with it.

Every plan names a history window — 30 days on Free, up to two years on Agency — and that is how far back the product will show you. It is a limit on what we display, not a deletion schedule: a snapshot is kept until the organisation or the installation is deleted, and then it goes with everything else on the schedule below. We would rather write that than claim a deletion job we have not built.

Your account email address is held for as long as the account exists, and goes when the organisation is deleted. Billing records are held by Lemon Squeezy as merchant of record, under their own retention and the tax law that binds them; we hold no card details at all.

When you uninstall the GitHub App, that installation’s data is marked for deletion immediately and permanently erased within seven days. Removing a single repository from the installation does the same for that repository. An owner can delete an entire organisation from the settings screen without contacting us, on the same seven-day schedule.

The delay exists so an accidental uninstall does not destroy history that cannot be rebuilt. It is well inside the thirty days the GitHub Marketplace agreement allows. Every deletion is recorded, and we can produce that record if your client asks for evidence.

The United States: Supabase in AWS us-west-2 and Vercel in iad1. If you are in the EU or UK, transfers are covered by the standard contractual clauses in our providers’ data processing agreements.

We chose the United States because every upstream the scanner reads is hosted there, so colocating removes a transatlantic round trip from each request. If a client contract requires EU residency, that is available on the Enterprise plan.

If the GDPR or UK GDPR applies to you, you have rights of access, rectification, erasure, restriction, portability and objection. Most of them are self-serve rather than a request form: your data is exportable as CSV or CycloneDX from any repository page, and deletion is a button in settings.

For anything that is not, or if you want the record of what we deleted, email privacy@libyears.com. We answer within 30 days and usually much sooner.

You also have the right to complain to a data protection supervisory authority. In the EU that is the authority in the country you live or work in, and in the UK it is the Information Commissioner’s Office. We would rather you wrote to us first, but the right does not depend on that.

Where we act as a processor rather than a controller — which is the case for the repository data an agency holds about its clients — we act on your instructions. Ask at privacy@libyears.com for a data processing agreement and we will send one for signature, with the subprocessor list as its annex. It is not yet a self-serve download, so it takes an email and a day.

If customer data is exposed, we will tell affected customers what happened, what was exposed and what we did, without waiting to have a complete story first. A partial notification on the day beats a polished one a fortnight later.

Material changes are announced before they take effect. A new subprocessor is announced before it starts handling data, which is a commitment the subprocessor list exists to make checkable.