Terms

Last updated October 11, 2026

These terms cover your use of Who's There? at whosthere.dev, its app, its GitHub app and its MCP server for AI tools. By using it, you agree to them. They're written to be read; if anything is unclear, email support@whosthere.dev.

Who we are

Who's There? is run by Bour Abdelhadi, an individual based in the United Kingdom ("we", "us"). You can reach us at support@whosthere.dev.

What the service does

Who's There? shows who can publish the npm packages your app depends on, watches public npm data for changes to those people and their releases, and tells you when something looks wrong. It reads public data from npm, domain registries and GitHub.

Everything it shows is a signal, not a verdict. A new maintainer is often a new teammate; a release built outside CI is often fine. We describe what changed and why it can matter, as accurately as we can, but we can't tell you whether a package or a person is safe, and we can miss things. Who's There? helps your own security work. It doesn't replace it.

Your account

• You sign in with Google. One account is for one person; keep access to it to yourself.
• You must be at least 18, or old enough to agree to these terms where you live. If you use Who's There? for a company, you confirm you may agree to these terms for it.
• You can delete your account at any time in Settings › Account. That deletes your projects, alerts and AI tokens, and cancels a Pro subscription straight away.

Plans and payment

• Free costs nothing. Pro costs the price shown on the site when you subscribe (currently $29 a month or $290 a year), plus any tax that applies. Payment is handled by Stripe; we never see your full card number.
• Pro renews automatically at the end of each month or year until you cancel. Cancel any time in Settings › Plan › Manage billing. Pro stays on until the end of the period you've paid for, then your account goes back to Free.
• Refunds. If you ask within 14 days of your first Pro payment, we'll refund it in full. After that, payments for the current period aren't refunded, except where the law says otherwise. If something went wrong, email us anyway.
• If we change Pro's price, we'll tell you at least 30 days before it applies to your next renewal, so you can cancel first.
• What each plan includes is listed on the site and in the guides. We may improve or change features; we won't take away something central to Pro in the middle of a period you've paid for.

Fair use

Plans have daily limits (quick scans, package checks from AI tools) so the service stays fast and affordable. Please don't:

• get around those limits, for example with many accounts or by spreading requests across addresses;
• scrape the service, resell it, or use it to build a copy of it;
• overload it, probe it for weaknesses without our permission, or interfere with other people's use;
• use what it shows to harass, threaten or impersonate package maintainers, or to take over their accounts or domains;
• use it for anything illegal.

Found a security problem in Who's There? itself? Please tell us at support@whosthere.dev before telling anyone else.

What you share with us

When you scan or watch a project, we process its package names (and, for a connected repo, its lockfile and package.json) to provide the service, as described in the Privacy page. They stay yours. You give us permission to use them only to run Who's There? for you. You confirm you have the right to share them, including any repos you connect for your employer or clients.

Connected GitHub

• Connecting GitHub installs the Who's There? GitHub app on the account or organization you choose, for the repos you choose. It has read-only access to code. On pull requests, for projects where you turn pull request checks on, all it writes is its own "Who's There?" check and one comment about what it found (which you can turn off).
• We read only lockfiles and package.json from those repos, and never store your code.
• You need permission to install the app on an organization, and to watch its repos. You can remove the app's access on GitHub at any time.
• GitHub's own terms also apply to your use of GitHub.

AI tools, tokens and alerts

• AI tokens (for the MCP server) act as your account. Keep them secret; you're responsible for what's done with them. Revoke one any time, and we may revoke tokens that are misused.
• Alerts are sent to services you choose (Slack, Discord, Microsoft Teams, email, webhooks). We send them promptly but can't promise delivery, because those services are outside our control. Check your Changes page too.
• An AI tool that uses Who's There? decides for itself what to do with our answers. We're not responsible for what it does.

Public data about maintainers

Who's There? shows information from public npm data, such as maintainers' usernames, their email domains (never addresses) and release history. It's there so people can judge the code they run. If you maintain packages and something we show about you is wrong, or you want your history removed, email us.

Share links and reports

A share link is public: anyone with it sees the project's name and summary numbers. Only make one if that's fine for the project. PDF reports are made in your browser; who you send them to is up to you.

Availability

We work to keep Who's There? running and accurate, but we don't promise it will always be available, error-free or able to catch every change. We may change, pause or stop parts of it. If we ever shut down Pro, we'll give you notice and refund any time you've paid for and not used.

If we need to suspend an account

If you break these terms in a serious way, or in a way that puts the service or other people at risk, we may suspend or close your account. Where it's reasonable, we'll tell you why first and give you a chance to fix it. If we close a paid account without good reason, we'll refund the unused part of your period.

No warranty

Who's There? is provided "as is" and "as available". As far as the law allows, we don't give promises that aren't written in these terms, for example that it fits a particular purpose or that any package, maintainer or release it shows is safe or unsafe.

Liability

As far as the law allows, we're not liable for indirect or consequential loss, or for lost profits, revenue, data or goodwill, arising from your use of Who's There?, and our total liability to you is limited to what you paid us in the 12 months before the claim (or £50, if that's more).

Nothing in these terms limits liability for death or personal injury caused by negligence, for fraud, or for anything else the law doesn't allow us to limit. If you're a consumer, you keep all the rights consumer law gives you.

Changes to these terms

We may update these terms as the service changes. If a change matters, we'll show it in the app or email you at least 30 days before it applies to you; small fixes (like typos) apply straight away. If you don't agree with a change, you can cancel and delete your account before it applies.

Law

These terms are governed by the law of England and Wales, and the courts of England and Wales can settle disputes. If you're a consumer living elsewhere, you keep the protection of the mandatory laws of your country, and you can bring a claim where you live.

Contact

Questions, billing, takedown requests or anything else: support@whosthere.dev.