Privacy and cookies
Last updated 24 October 2026.
This page covers what personal data Firetruck collects when you use firetruck.dev and the Firetruck API, why, how long we keep it, and how to control or delete it. Short version: package lookups don't need an account, we don't sell data, and we don't use it for advertising.
Who's the data controller
Firetruck, based in the European Union, is the data controller for the processing described here. For any privacy question or request, email privacy@firetruck.dev.
What we collect and why
The legal basis column cites the article of the GDPR that allows each use, in case you need it for your own compliance work.
| Purpose | Data | Legal basis |
|---|---|---|
| Answering package lookups | The package name and version you submit | Needed to provide the service: contract for account holders (Art 6(1)(b)), otherwise legitimate interest in answering the lookup you asked for (Art 6(1)(f)) |
| Signing you in and managing API keys | Email address and account identifier; sign-in links and sessions (stored only as hashes); API keys (stored only as hashes), plus each key's name and dates | Needed to provide the service (Art 6(1)(b)) |
| Running organizations | Email addresses and roles of an organization's members, and the organization's name and its URL name (slug), which an owner chooses and can change and which may identify a company | Needed to provide the service to you (Art 6(1)(b)); for people an owner adds, legitimate interest in letting an organization manage its own members (Art 6(1)(f)) |
| Analytics across visits and optional session replay | Pages viewed, product events, device and browser type, approximate location, a random identifier stored in your browser; for replay, a recording of the page with all text and inputs masked, and the addresses and timing of network requests | Your consent (Art 6(1)(a) GDPR; Art 122 Italian Privacy Code for storage on your device) |
| Cookieless usage statistics | Pages viewed, referrer, campaign tags, device and browser type, approximate location; nothing is stored on your device | Legitimate interest: understanding how the service is used (Art 6(1)(f)) |
| Account activity metrics (sign-ups, API keys created or revoked) | An identifier derived from your account with a secret key. It can't be turned back into your email address without that key. | Legitimate interest: measuring adoption (Art 6(1)(f)) |
| Error monitoring | Error messages and the page or request involved, with emails, API keys and tokens removed before sending | Legitimate interest: keeping the service working (Art 6(1)(f)) |
| Running and securing the site and API | IP address, request details and timestamps in our hosting providers' logs | Legitimate interest: security and reliability (Art 6(1)(f)) |
You can look up packages without giving us any personal data. To use the API, you need to give us an email address. Without it we can't send you sign-in links.
We don't store the package names you look up. Analytics records that a lookup happened, which package ecosystem it was for, the result (found, not found, or couldn't verify) and how many known exploited vulnerabilities it found. It includes the package name only when the lookup matched a vulnerability in the public catalog, so we don't send the names of internal or private packages from lookups to analytics.
We email you only to send sign-in links, including to an address an organization's owner has added. We don't make decisions about you by automated means. Firetruck is not directed at children under 14.
Organizations
Every account belongs to an organization. An organization's owner adds members by typing their email addresses, which can belong to people who have never used Firetruck. When an owner adds an address we email that person a sign-in link, and until they have signed in the owner can ask us to send it again. Members of an organization can see each other's email addresses and roles. Nobody outside the organization can see them, apart from us and the providers listed below. If an owner added your email address and you want it removed, email privacy@firetruck.dev.
Analytics and your choices
We use PostHog for analytics. The first time you visit, a banner asks whether you accept analytics cookies and similar browser storage and, separately, session replay. Both are off unless you turn them on, and replay requires analytics. Rejecting is as easy as accepting. Closing the banner counts as rejecting. Scrolling or using the site is never treated as consent.
Until you choose, if you reject, or if your browser sends a Do Not Track or Global Privacy Control signal, we still count visits, but nothing is stored on your device. PostHog counts these visits with a hash of your IP address and browser that is computed on its servers and changes every day. It can't follow you from one day to the next, and no profile or replay is created.
If you accept analytics, PostHog stores a random identifier in your browser so it can connect visits across days. If you are signed in, it also links them to the account identifier described above. If you also accept replay, PostHog records how pages are used. All text and form inputs are masked. The addresses and timing of network requests are recorded, but not their headers or contents, and console output is not recorded.
PostHog receives your IP address with each request and uses it to estimate your approximate location. You can change or withdraw your choice at any time with "Cookie settings" in the footer of every page. Withdrawing stops replay and removes the analytics identifier, after which we count your visits only without cookies, as described above. It doesn't affect processing that happened before. We keep your choice for 12 months and don't ask again sooner unless the purposes change or your choice is lost.
Who we share data with
We use these providers to run Firetruck. We require each of them to sign a data processing agreement that allows them to use data only on our instructions.
| Provider | What for | Where |
|---|---|---|
| PostHog | Product analytics, session replay and error monitoring | PostHog EU Cloud (Frankfurt, Germany); PostHog, Inc. is based in the US |
| Cloudflare | Hosting the website, content delivery, security, and sending sign-in emails | Global network; Cloudflare, Inc. is based in the US |
| Fly.io | Hosting the API and its database | Fly.io, Inc. is based in the US |
Where a provider may access personal data from outside the European Economic Area, the transfer is covered by the European Commission's standard contractual clauses or another legally recognised safeguard. You can ask us for a copy of these safeguards at privacy@firetruck.dev. We don't share personal data with anyone else unless the law requires it.
How long we keep data
| Data | Kept for |
|---|---|
| Sign-in links | Usable for 15 minutes; deleted within 30 days of expiry |
| Sign-in sessions | Valid for 60 minutes; deleted within 30 days of expiry |
| Account and API key records | While your account exists; deleted within 30 days of an erasure request |
| Organization members | While they belong to the organization; removed when an owner removes them or they leave |
| Analytics events, consent records and error reports | 13 months, so a consent record outlives the 12-month choice it proves |
| Session replays | 30 days |
| Hosting and security logs | Up to 30 days |
Your rights
Your right to object. You can object at any time to processing based on legitimate interest, including cookieless statistics, account activity metrics, error monitoring and security logs, by emailing privacy@firetruck.dev.
You can also ask for access to your personal data, and for its correction, erasure or portability, or for its processing to be restricted. You can withdraw consent at any time in Cookie settings.
To make a request, email us from the address linked to your account at privacy@firetruck.dev. If you don't have an account, tell us which data your request is about. We reply within one month. Erasing your account also deletes the analytics data linked to it through your account identifier.
You can also complain to the Italian data protection authority, the Garante per la protezione dei dati personali, or to the authority where you live or work.
Changes to this notice
We will update the date at the top when this notice changes. If we add a new purpose for cookies or similar technologies, the banner will ask for your choice again.