Privacy

Without an account

You can search, compare and check a project without signing in.

• Reports you make keep their file names and dependency list, linked to a random id in a cookie (dd_owner, one year) so you can find them again.
• Search picks (which result you chose for a query) are kept the same way, to put your usual packages first.
• Comparison counts: how many times a range was viewed each day, with nothing about who viewed it.
• Corrections you send keep your IP address, to stop abuse.
• Analytics: Google Analytics counts page views and searches. It runs only if you allow it in the banner or in Settings, and only then sets its own cookies (_ga). Turning it off stops it in this browser.

Visitor counts

To understand how DepDelta is used, we count page views ourselves, for every visitor. We set no cookie and store no IP address, no full URL and nothing that identifies you. Each view adds one to daily totals for the page path, the kind of page, the referring site or campaign (utm_source), your country (from our network provider), your device type, your browser and operating system, and your browser's user agent string. To estimate unique visitors per day, we keep a one-way hash of your IP address and browser, combined with a random value that changes every day and is deleted after two days, so you can't be recognised from one day to the next. We don't count you if your browser sends Do Not Track or Global Privacy Control. Automated crawlers are counted only by name.

With an account

Signing in with GitHub, Google, GitLab or Codeberg keeps your handle, name, email and avatar from that provider, and what you save: follows and their alerts, reports, checklist progress and preferences, including the language your emails are written in. Each provider you sign in with is linked to the same account by its verified email, and that provider's email is kept to show it in Settings.

Sessions use two cookies: dd_session (signed-in session, up to 90 days) and dd_auth (says you're signed in, nothing else).

Connecting GitHub

Connecting GitHub to check private repositories keeps your GitHub login and an access token, encrypted. It's used only to list the repositories you gave DepDelta and read their manifests and lockfiles when you make or refresh a report. Disconnecting in Settings deletes the token and revokes it on GitHub.

The GitHub app

The DepDelta GitHub app reviews dependency pull requests in the repositories you install it on. Nothing in your repositories is ever run, and uninstalling the app on GitHub stops all of it. For each pull request it:

• Reads the manifests and lockfiles the pull request changes, to see which versions it moves.
• Reads the pull request's code when an update removes or changes APIs, to find where the repository uses them. The code is read in memory and discarded; only the matching lines (file, line number and API name) are kept, for a day, and shown in the review.
• Keeps the repository's name and, per pull request, its title, author, head commit and the review's verdict, to show them on your Updates page.
• Writes one comment and one check on the pull request. It never pushes code or changes anything else.

The depdelta command

API keys you make in Settings let the open-source depdelta command post DepDelta reviews from your CI, on Gerrit, GitLab, Forgejo, Gitea, Bitbucket or Azure DevOps. Only a hash of each key is stored, with its name, when it was made and when it was last used; revoking a key keeps that record.

Your credentials for those hosts stay in your CI and go only to the host, never to DepDelta. Each finished review is kept for a day, so CI can retry without making it again. For each review, CI sends:

• The manifests and lockfiles the change touches, before and after, and the repository's .depdelta.yml if it has one.
• Where your code uses changed APIs, when an update removes or changes them: the file, line and name of each use the command found in your checkout. Nothing else from your code is sent.

Emails

Signed in, you can have DepDelta email you a digest and alerts for what you follow, in the language you pick, alongside messages about your account. Every digest and alert has a one-click unsubscribe, and Settings turns them off. DepDelta sends its emails from its own mail server, with no email service in between.

The contact page

The contact page keeps what you write, the email address you give, your name if you add it, and the package or comparison it's about. Signed in, the message is linked to your account. Your IP address isn't kept with it.

Your message reaches us by email at our own address, and replies go to the address you gave. It's used only to answer you and to fix what you reported, and it signs you up for nothing.

Who else is involved

DepDelta doesn't sell your data or share it with anyone but these:

• DepDelta's own servers hold the data above, reached through Cloudflare.
• GitHub, Google, GitLab and Codeberg when you sign in with them; GitHub for the connection and the app.
• Google Analytics, only if you allow it.
• DeepSeek summarises public release notes. It never receives your data or your code.

Outside the EU

GitHub, Google, GitLab and Cloudflare are based in the United States, so data they handle may leave the EU. They are covered by the EU–US Data Privacy Framework and the European Commission's standard contractual clauses. Codeberg is based in Germany.

Why it's allowed

• To give you what you asked for: your account, what it saves, the GitHub connection, the reviews from the app and the depdelta command, and the emails you turn on (performing a contract).
• To answer you: messages from the contact page (legitimate interests).
• To run and protect the service: the report cookie, search picks, comparison counts, the IP address on corrections and server logs (legitimate interests).
• Only with your consent: analytics. You can withdraw it at any time in Settings.

How long it's kept

Your account and what it saved stay until you delete them. GitHub's webhook deliveries are kept for a week, usage-check results and the depdelta command's reviews for a day. Server logs, which can include IP addresses, are kept only as long as needed to run and secure the service. Contact messages stay as long as they're needed to answer you and follow up, and are removed if you ask.

Removing your data

Settings deletes your account and everything it saved, API keys included, and disconnects GitHub. Corrections you sent stay, no longer linked to you. Contact messages stay with the address you gave, no longer linked to your account.

Your rights

You can ask for a copy of the personal data DepDelta holds about you, have it corrected or erased, receive it in a portable format, and object to or restrict how it's used. Requests are answered within a month.

To make one, to remove reports made without an account, or to remove a contact message, email hello@depdelta.com.

You can also complain to the data protection authority where you live or work. In Sweden, that's Integritetsskyddsmyndigheten (IMY).

Changes

When this policy changes, the date at the top changes with it.