Terms of service

libyears is sold by YalsTech, a business based at 7/68-46-1, Plot No 90, Sivasakthi Gardens Phase -3, Keeranatham, Coimbatore, Tamil Nadu - 641035, India. YalsTech is a trading name and not a registered company, so the contract is with Shenbagapriya Bakthavachalam, the person who trades under it. We would rather say that than borrow the appearance of a corporation we do not have.

“We” and “us” below mean that business; “you” means the organisation whose repositories are connected, and the person accepting these terms warrants they may accept them on its behalf.

Payment is a separate contract. Lemon Squeezy is the merchant of record and sells the subscription to you as the seller; their terms govern the sale, the invoice and the tax. These terms govern the service.

libyears reads the dependency manifests and lockfiles in repositories you connect, compares what you have installed against what has been published, and reports how far behind you are and what is known to be dangerous.

It is read-only. It never writes to your repositories, never opens a pull request, and never changes your code. That is a deliberate limit on the product, not an omission.

It is not a security audit, a penetration test, or a compliance certification, and it does not find vulnerabilities in your own code. It reports what public advisory databases say about third-party packages you depend on.

A clean report means no public advisory matched the versions you have installed. It does not mean your dependencies are safe, and it never will: a vulnerability nobody has published cannot be reported by anyone. Decisions about upgrading, and their consequences, remain yours.

Effort estimates are bands derived from how far behind a package is and how widely it is used. They do not account for what changed between two releases. They are an input to a quote, not a quote.

You need an account and a connected repository host. You are responsible for who you invite and what they can see: a viewer seat is safe to hand to a client because a viewer can read everything and change nothing, but an admin can change thresholds and remove repositories.

One free organisation per person. Creating several free organisations to avoid the repository limit is the one form of abuse worth naming, and we will consolidate them rather than terminate an account over it.

Plans and prices are on the pricing page and on the settings screen. Payment is handled by Lemon Squeezy as merchant of record: they are the seller, they collect the money, and they issue the invoice. Card details never reach this application, which is why there is no payment form in it.

Subscriptions renew until cancelled. Cancelling stops the next charge and drops you to the free plan at the end of the period you have paid for. We do not prorate refunds for a period already begun, but if you cancel because the product did not work, write to us and we will refund it. Because Lemon Squeezy is the seller, a refund is issued by them; ask us and we will instruct it, or use their receipt directly. Where consumer law gives you a cancellation right their policy cannot reduce, that right applies whatever this paragraph says.

Over your plan’s repository limit, scanning pauses. Nothing is deleted. Every repository, every past scan and every report stays exactly as it was; the numbers simply stop updating, and the interface says so. Raising the plan brings them straight back. Downgrading has to be safe or trying a paid plan is not, so this is how the entitlement code actually behaves and not only a promise.

Your repository data is yours. We process it to provide the service and for nothing else: not to train models, not to sell, not to compile into a dataset about you. Aggregate statistics we publish — median libyears across public repositories, for instance — are derived from public repositories only and never identify a customer.

You can export any repository as CSV or CycloneDX at any time, and delete your organisation yourself without contacting us. The privacy policy says what we hold and for how long.

There is no uptime commitment on the free, Pro, Team or Agency plans, and we would rather say that than offer one we have not measured. Enterprise agreements can include one.

Scans depend on GitHub, the npm registry and public advisory databases. When one of them is unavailable the affected data goes stale rather than disappearing, and the interface says which repository stopped updating and why.

The service is provided as-is. We do not warrant that it is error-free or that it will identify every outdated or vulnerable dependency.

Our total liability is limited to what you paid us in the twelve months before the claim. For a free account that is nothing, which is the honest consequence of a free account. We are not liable for indirect or consequential loss, for lost profit, or for the cost of an upgrade you decided to make.

Nothing here limits liability for fraud or fraudulent misrepresentation, for death or personal injury caused by negligence, for gross negligence or wilful misconduct, or for anything else that cannot be limited under the law that applies to you. Several jurisdictions would strike those carve-outs out if they were missing, so they are here rather than being left to be argued about.

We are not liable for a security incident in your dependencies. We report what the public record says; acting on it is yours.

Cancel any time from settings. Delete your organisation any time from settings. Neither requires talking to us, and there is no retention offer in the way.

We may suspend an account for non-payment after notice, or for use that endangers the service or other customers. If we discontinue the product we will give at least 90 days’ notice and keep exports working throughout.

These terms are governed by the laws of India, where we are based, and the courts at Coimbatore, Tamil Nadu have exclusive jurisdiction, except that nothing stops either of us seeking an injunction wherever it is needed. If you are a consumer rather than a business, the mandatory law of the country you live in still applies to you; this product is sold to businesses.

We may change these terms. Material changes are announced at least 30 days before they take effect, by email to organisation owners, and the date at the top of this page says which version you are reading. Continuing to use the service after that is acceptance; if you would rather not accept, cancel and the change never reaches you.

If a clause here is unenforceable, the rest stands and that clause is read down to what is enforceable. You may not assign these terms without our consent; we may assign them to a successor of the business, on notice. These terms and the privacy policy are the whole agreement between us about the service, replacing anything said before them. A right we do not enforce immediately is not a right we have given up.

The MIT components — the parsers, metrics, registry client and CLI — are licensed under MIT and nothing here restricts that.

Questions: hello@libyears.com.