Privacy
Last updated October 30, 2026
Who's There? shows who can publish the npm packages your app depends on, and watches for changes to them. This page explains what we collect, why, how long we keep it and who else is involved. It's written to be read; questions go to support@whosthere.dev.
- Scanning needs no account. Your lockfile is read in your browser and never uploaded.
- We never see or store your code. For watched projects we keep the list of package names, not the lockfile.
- Connected GitHub is read-only, limited to the repos you choose, and reads only lockfiles and package.json.
- No ads and no tracking cookies. We count page views with Vercel's cookieless analytics. We don't sell or share your data.
Who is responsible
Who's There? is run by Bour Abdelhadi, an individual based in the United Kingdom, who is the data controller for the information described here. Contact: support@whosthere.dev.
Scanning without an account
- Your browser opens the lockfile and lists the packages in it. The file stays on your device.
- To start a scan, your browser sends the project name, the number of packages and a fingerprint of the package list (a one-way hash, so a rescan of the same project isn't counted twice).
- Your browser sends the package names to our server, which asks the public npm registry who can publish each one, plus their weekly downloads.
- For maintainers' email domains (from public npm data), our server asks the domain registries whether each domain is registered and when it expires.
- Our server asks OSV (osv.dev) whether any of the packages, by name, have known-malware advisories. Your browser compares them with the versions you have installed.
- Your browser puts the results together. The PDF report is made in your browser too.
If you scan a public GitHub repo instead, our server fetches its lockfile from GitHub and passes it to your browser.
| What we keep from scans | Why | Kept for |
|---|---|---|
| A count of your scans, under a one-way hash of your IP address. We never store the IP itself. | Daily limits, so the free tier stays free. | 1 day |
| The fingerprint of each project you scanned. | So rescanning the same project the same day isn't counted again. | 1 day |
| Public data about npm packages and maintainers' email domains. | A shared cache, so scans are fast. Not linked to you. | Up to 1 day |
| A public repo's lockfile, when you scan from GitHub. | So the same repo isn't fetched again straight away. | 10 minutes |
| A usage record: that a scan happened, whether by a guest, Free or Pro account, how many packages, and a public repo's name if you scanned one. Guests appear only as the hashed key above. | To understand how the service is used and plan capacity. | 180 days |
| A share link, if you make one: the project name, summary numbers and up to five public avatar hashes. | So the link and its preview keep working. | 1 year |
Your browser keeps your last scan on your device so a reload doesn't lose it. It's cleared after 7 days, or when you clear your site data.
Public npm data we keep
npm keeps every release but forgets people. To spot account takeovers, we keep a record of public npm data for the packages people look at or watch. It's about packages and their maintainers, never linked to who scanned what:
- which npm accounts can publish a package, and when that changed;
- each account's email domain, and a one-way hash to notice when the email changes. We never store email addresses;
- recent releases: who published them, whether CI built them, install scripts, dependencies and size;
- whether maintainers' email domains are registered, and when they expire;
- a track record built from the above (for example, how long an account has been releasing), shown as a short verdict.
If you maintain packages and something we show about you is wrong, or you'd like your history removed, email us.
If you sign in
Signing in (with Google) is only needed to watch projects. Then we also keep:
| What | Why | Kept for |
|---|---|---|
| Your account: the name, email and picture Google shares. | To identify your account and show who's signed in. | Until you delete it |
| Your projects: the repo name (or, for an upload, only the package names), the list of package names in the lockfile, and a fingerprint of the lockfile to notice changes. Never the lockfile itself. | To watch those packages for you. | Until you delete the project |
| A summary of each project scan (its findings, such as which packages got new maintainers). | Findings, history and the Overview on any device. | 1 year, or until you delete the project |
| Alerts: where they go (a Slack, Discord or Teams webhook, an email address, or your own webhook URL and its signing secret), which projects, the level, and whether a summary is on. Plus which alerts were sent, and the last delivery error if one fails. | To send alerts once, and tell you when one can't be delivered. | Until you delete the alert |
| AI tokens: a one-way hash of each token, never the token itself. Plus a log of calls made with them: which tool, a short summary (package names, counts), and how it went. | So your AI tools can use your projects, and you can see what they did. | Tokens until revoked; the log 90 days |
| Your plan: Free or Pro, its status, your email, and (on Pro) the Stripe customer and subscription IDs. | Billing, and Pro given by hand. | See "Deleting your account" |
| A list of the projects your account has added, with your email. | Free includes one project; this stops the slot being reset by deleting it or signing up again. | See "Deleting your account" |
Connected GitHub
On Pro, you can install the Who's There? GitHub app on your account or organization to watch private repos.
- Access: read-only on code, and only for the repos you choose on GitHub. It can't change code, branches or pull requests. On pull requests, if you turn checks on, all it writes is its own check and one comment about what it found.
- What we read: the lockfile and package.json of repos you watch, and nothing else. Your code is never read or stored.
- What we keep: the installation's ID, the GitHub account name it's on, and which of its repos you can reach (to show you only those). We don't store GitHub tokens: short-lived ones are made when needed and kept only in memory.
- When you push: GitHub tells us which branch changed and which files changed, so we know when to re-read the lockfile. We don't keep these messages.
- Pull request checks (if you turn them on for a project): we read which files a pull request changes, and its lockfile and package.json before and after, to post the check, and (unless you turn it off) one comment that we update on each push. The comment and the check say which packages were flagged and why; they're visible to anyone who can see the pull request. We keep a short record of each check (the pull request's number, title and link, the result, and how many packages it added, upgraded or flagged) for the project's Pull requests tab: kept for a year, and deleted with the project.
- Removing access: uninstall the app on GitHub, or disconnect it in Settings › Scanning.
Payments
Pro payments are handled by Stripe. Your card details go to Stripe, never to us. We keep only what's listed under "Your plan" above. Stripe keeps payment records under its own privacy policy and the law.
Google user data
When you sign in with Google, Google shares your name, email address and profile picture with us (through Supabase, which runs our sign-in). We use them only to identify your account, show who's signed in, and send the emails you ask for (like alert emails and billing notices). We don't ask for access to anything else in your Google account, we don't use this data for ads, and we never sell it or share it except with the providers that run the service, listed below. You can delete your account and its data at any time.
Who's There?'s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Who else is involved
- npm (
registry.npmjs.org,api.npmjs.org): our server asks about packages by name. npm sees our server, not you. - OSV (
api.osv.dev, run by Google with the OpenSSF): our server asks for known-malware advisories by package name. OSV sees our server, not you. - Domain registries (via
data.iana.org, andcloudflare-dns.comas a fallback): to check maintainers' email domains. - GitHub: public repos you scan, and the GitHub app for repos you connect. When you type a repo, your browser loads the owner's avatar from GitHub.
- Gravatar (
gravatar.com): your browser loads maintainers' profile pictures from it, which can see your IP address, like any image on the web. - Vercel hosts the site and keeps standard request logs for a short time under its own policy. Its Web Analytics counts page views for us: which pages are visited, the referring site, and the browser, device type and country. It sets no cookies and doesn't identify you or follow you across sites, and we send it only the page's path, never what's after the "?".
- Supabase runs sign-in and the database.
- Upstash runs the short-lived shared cache described above.
- Stripe handles Pro payments.
- Anthropic (Claude) reads the code of public npm releases that look risky and explains what it does. We send only public npm package code, never your code, lockfiles or anything about you.
- Resend sends our emails: alert emails and summaries, address confirmations, notices when an alert can't be delivered, and a few account emails (a welcome when you sign up, when Pro starts or ends, and when an account is deleted). No newsletters or marketing.
- Slack, Discord, Microsoft Teams or your own server receive the alert text we send, only if you set up an alert there.
- Google handles sign-in.
Some of these providers process data outside the UK, for example in the United States. Where they do, they rely on the safeguards the law requires, such as standard contractual clauses.
On your device
We don't use tracking cookies. Your browser keeps a few things in its own storage: your sign-in session (so you stay signed in), your theme and small preferences (like which groups you folded away), your last scan for up to 7 days, and the parsed lockfile of an uploaded project (so you can rescan it there). Clearing your site data removes them.
Deleting your account
Settings › Account › Delete removes your projects (with their package lists and scan history), alerts, connected GitHub accounts, AI tokens and their call log, and your sign-in account, and cancels a Pro subscription straight away.
Two small records stay: your plan record (email, plan and Stripe IDs, which we may need for billing and tax), and the list of projects your account added with your email (so Free's one project can't be reset by signing up again). Usage records drop off after 180 days. If you'd like these removed too, email us and we'll do it, unless we have to keep billing records by law.
Your rights
Under UK data protection law (UK GDPR) you can ask for a copy of your data, ask us to correct or delete it, or object to how we use it. Email support@whosthere.dev and we'll reply within a month. Our reasons for using your data are: to provide the service you asked for (your account, projects, alerts and payments), and our legitimate interest in keeping it running, fair and secure (limits, usage counts, public npm history). If you're unhappy with how we handle your data, you can complain to the Information Commissioner's Office.
What we don't do
We don't sell or share your data, run ads, or set tracking cookies. The only analytics is Vercel's cookieless page-view count, described above. We don't look at your code: scans and watching use package names and public npm data.
Changes and questions
If any of this changes, this page changes first, and for anything that matters we'll tell signed-in users in the app or by email. Questions: support@whosthere.dev. The Terms cover using the service.