Privacy Policy
Last updated: 25 October 2026 · Effective: 25 October 2026
Draft notice: controller name, controller address, grievance officer name must be published here before launch.
Who we are
snarlmap ("we", "us") is a hosted service that maps the dependencies of software projects. We decide why and how your personal data is processed, which makes us the "data controller" under the GDPR and UK GDPR and the "data fiduciary" under India's Digital Personal Data Protection Act, 2023 (DPDP Act).
What we collect
Account data. When you sign in with GitHub or Google we receive your provider ID, username, display name, picture and, if available and verified, your email address. We do not receive your password.
GitHub access. If you sign in with GitHub, we hold an access token (scopes: read:user, user:email, repo) so that we can read the repositories you ask us to analyze, including private ones. The token is kept server-side for the life of your session and is never stored in your cookie or our database. GitHub's "repo" scope is broader than we need; GitHub offers no narrower read-only option for private repositories, and we only ever read.
Billing data. If you subscribe, we store your plan, billing interval, status, payment provider, provider customer/payment IDs and the end of the paid period. Card and bank details are entered with Stripe or Razorpay and never reach our servers.
Content you analyze. For GitHub repositories we download up to 500 source files (1 MB each) to a temporary directory, extract import statements, and delete the files when the request ends. For local folders, your browser first skips credential files (such as .env files, private keys and cloud credentials), keeps only recognised source files and dependency manifests, and replaces secret-looking values with [REDACTED] before anything is uploaded. Our servers apply the same filter again. Files are held in a temporary directory while the request runs and are never stored, cached or logged.
Emails and feedback. If you email us (hello@, support@ or [email protected]) or send product feedback, we receive your email address and your message. We use them only to reply and to improve snarlmap. The contact form on our site does not send anything itself: it opens your own email app.
Things you create. API keys (stored only as a one-way hash), blog posts and comments you publish. Comments you write while signed in are linked to your account so we can export and erase them.
Technical data. All traffic reaches us through Cloudflare, our CDN and tunnel provider, which sees your IP address and requests in transit. Our web server records a truncated IP address, time, request method, path, status code and response size. It does not record query strings (which could contain repository names), user-agent or referrer.
Crash reports. If the app hits an error, a report is sent to Sentry, our error-monitoring provider (EU data region). It contains the stack trace and error message with secrets and repository names removed, your browser and operating-system type, and the page path without its query string. We do not attach cookies, headers, request bodies, your account identity or your files. Sentry's servers necessarily see the IP address a report arrives from; we do not add it to the report and we ask Sentry not to store it. Reports are kept for up to 90 days.
Anonymous reaction buttons on blog posts use a hashed identifier derived from your session or IP address to stop duplicate votes.
How we use it and our legal bases
To provide the service you asked for: signing you in, analyzing what you select, running security scans and SBOM exports, and managing your plan. Legal basis: performance of a contract (GDPR art. 6(1)(b)); under the DPDP Act, your voluntary provision of data for that purpose.
To keep the service secure and prevent abuse: rate limiting, fraud and abuse prevention, debugging, and finding and fixing crashes through error reports. Legal basis: our legitimate interests (art. 6(1)(f)) and, under the DPDP Act, legitimate uses for security.
To remember your theme, preferences and local analysis history on your device. Legal basis: your consent (art. 6(1)(a)), which you can withdraw at any time.
To meet legal obligations such as tax and accounting, through our payment processors (art. 6(1)(c)).
We do not sell your personal data, we do not "share" it for cross-context behavioural advertising, we run no advertising or analytics trackers, and we do not make decisions about you by automated means that have legal or similarly significant effects.
Who we share data with
| Provider | Purpose | Data involved | Location |
|---|---|---|---|
| GitHub | Sign-in; reading repositories you ask us to analyze | Your GitHub profile and the repository files you select | United States |
| Sign-in | Your Google profile (name, email, picture) | United States | |
| Cloudflare | CDN, TLS termination and the secure tunnel to our server. All traffic to snarlmap passes through it | IP address and the requests you make (it sees the traffic in transit); it may set a technical security cookie | United States / global network |
| Stripe | Card payments and subscriptions (USD). Not active during the free beta | Email, plan, payment details (entered at Stripe, never on our servers) | United States / EU |
| Razorpay | Payments (INR). Not active during the free beta | Email, plan, payment details (entered at Razorpay) | India |
| OSV.dev (Google) | Known-vulnerability lookup for the Security tab | Package names and versions from your dependency manifests | United States |
| PyPI / npm | Licence lookup for the Security tab | Package names and versions | United States / EU |
| Sentry | Error monitoring: tells us when the app crashes | Stack traces and error messages with secrets and repository names removed, browser and OS type, page path without query string. No cookies, request bodies, headers or user identity. Sentry sees the sender's IP address when a report arrives; it is not added to the report. | European Union (Germany) |
| Hosting provider | Runs our servers, database and cache | All data described in this policy | To be stated before launch |
These providers process data on our behalf or, for GitHub and Google sign-in, under their own terms. We require our service providers to protect your data and use it only to provide their service. We disclose data to authorities only where the law requires it.
International transfers
Our providers are located in several countries, including the United States and India, so your data may be processed outside the country where you live. Where the GDPR or UK GDPR requires it, transfers rely on an adequacy decision or standard contractual clauses. Under the DPDP Act, we transfer data only to countries that the Government of India has not restricted.
How long we keep data
| Data | Retention |
|---|---|
| Sign-in session and GitHub access token | Up to 7 days, or until you sign out. Held server-side; the token is never placed in your cookie. |
| OAuth security token (state) | 10 minutes |
| Analysis result (graph) | 10 minutes in a cache keyed to your account, then deleted. Never written to our database. |
| Repository files and uploaded local files | Held in a temporary directory only while your request runs, then deleted immediately. Never stored or logged. |
| Repository search results | 5 minutes |
| Rate-limit counters | Up to 1 hour |
| Subscription record (plan, status, provider IDs, email) | While your account exists. Erased when you delete your account. |
| Payment webhook event IDs (no personal data) | 90 days, to prevent duplicate processing |
| API keys | Until you revoke them or they expire (maximum 1 year). Stored only as a one-way hash. |
| Blog posts and comments you wrote while signed in | Until you delete them or your account |
| Reaction markers (a hashed identifier) | With the post they relate to |
| Error reports (Sentry) | Up to 90 days, then deleted automatically by Sentry |
| Emails you send us (support, feedback) | Kept only as long as needed to reply and to improve the product, then deleted on request |
| Server access logs | Truncated IP, time, method, path and status only. Kept in size-capped rolling files that are overwritten automatically as new entries arrive. |
| Optional preferences and history on your device | Until you clear them, withdraw consent, or delete your account |
| Payment records held by Stripe/Razorpay | Kept by them for as long as tax and accounting law requires; we do not hold card data |
When you delete your account, we erase your subscription record, API keys, blog posts and comments, cached results and every active session, and we cancel any active Stripe subscription first.
Your rights
You can exercise these from Settings → Privacy & data: download a copy of your data (access and portability) and permanently delete your account and data (erasure). You can also manage cookie and storage consent there at any time.
Under the GDPR and UK GDPR you also have the right to rectification (your profile comes from GitHub or Google, so correct it there), restriction, objection, withdrawal of consent, and to complain to your data protection authority.
Under the DPDP Act you have the right to access a summary of your personal data, to correction and erasure, to grievance redressal, and to nominate another person to exercise your rights if you die or become incapacitated.
If you live in California, you have the right to know, delete and correct your personal information and to opt out of its sale or sharing. We do not sell or share it, and we will not discriminate against you for exercising these rights.
To use a right that is not available in the app, email [email protected]. We respond within 30 days.
Children
snarlmap is intended for people aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us data, contact us and we will delete it.
Security and breaches
We protect data with encryption in transit, hashed API keys, server-side session and token storage, per-user isolation of cached results, input filtering and redaction of secrets in uploaded code, rate limiting and least-privilege containers. If a personal data breach occurs we will notify the relevant authorities and affected users as the law requires (for example, within 72 hours to GDPR supervisory authorities where applicable).
Changes to this policy
If we make material changes we will update the date above and, where required, notify you before they take effect.
Contact and grievances
Privacy requests and questions: [email protected].
Grievance Officer (DPDP Act): [name to be published], [email protected]. We acknowledge grievances within 7 days and aim to resolve them within 30 days. If you are not satisfied you may contact your data protection authority, or the Data Protection Board of India.