inspect.software processes two kinds of data: public data about software (the product) and a minimal amount of account data (to operate the service). This page states both plainly.
Public repository data
The record is computed from data that is already public: repository contents and history, hosting-platform metadata (stars, issues, releases, contributor statistics, owner profiles), and package-registry metadata (downloads, versions, deprecation state). Inspection reports republish and summarize this public data; they contain no private information.
Contributor-related metrics (such as maintainer resilience) are computed from public commit history and are reported as aggregates. For the displayed top ten contributors, authenticated scans may also retain self-published GitHub profile name, location, company, and public organization memberships for identity-resolution research. Those enriched profile fields are stored but withheld from public API and HTML reports. Self-published location — including the location of a public organization membership when GitHub supplies it — may feed the aggregate high-risk jurisdiction exposure policy signal within the current Russia, Iran, and North Korea scope. Public reports expose only country/role counts, never the contributor identity or raw location. Ambiguous matches do not affect the score, and the service does not infer nationality, citizenship, sanctions status, intent, or individual trustworthiness.
Account data
Signing in uses GitHub OAuth. The service stores the GitHub profile basics needed to operate an account: username, display name, avatar, and account identifiers, plus the account balance and its transaction history.
A GitHub access token is used at submission time to verify repository ownership or maintainer permission for paid scans. It is used for that authorization check and for the account session — not for reading private repository contents in free public scans.
Sessions, cookies, and analytics
Authentication uses a signed session cookie. The session data is held in the cookie and signed by the service; it is not a server-side login record.
The site also uses Google Analytics 4 to understand aggregate use of the public site. Google receives standard online identifiers and event data generated when the Analytics tag loads, including page views. Analytics is not used for advertising, remarketing, or selling personal data. Browser privacy tools or content blockers may prevent this tag from loading.
What is deliberately not collected
- No advertising profiles, remarketing audiences, or sale of personal data.
- No email marketing lists harvested from OAuth (email is used for transactional and support correspondence, not campaigns, unless explicitly requested).
- No private repository contents outside an explicitly commissioned private audit — and private audit reports are private to the commissioning account.
Data removal
Account deletion requests are honored via contact: account data and sessions are removed. Published inspection reports of public repositories are records of public data and remain published — see the terms on the public record.
Changes
Material changes to this policy are announced on this page with an updated date.