# Privacy

> What data inspect.software processes — public repository data, GitHub sign-in details, and session state — and what it deliberately does not collect.


inspect.software processes two kinds of data: **public data about software**
(the product) and **a minimal amount of account data** (to operate the
service). This page states both plainly.

## Public repository data

The record is computed from data that is already public: repository
contents and history, hosting-platform metadata (stars, issues, releases,
contributor statistics, owner profiles), and package-registry metadata
(downloads, versions, deprecation state). Inspection reports republish and
summarize this public data; they contain no private information.

Contributor-related metrics (such as
[maintainer resilience](/wiki/maintainer-resilience)) are computed from
public commit history and are reported as aggregates. For the displayed top
ten contributors, authenticated scans may also retain self-published GitHub
profile name, location, company, and public organization memberships for
identity-resolution research. Those enriched profile fields are stored but
withheld from public API and HTML reports. Self-published location — including
the location of a public organization membership when GitHub supplies it — may
feed the aggregate [high-risk jurisdiction exposure](/wiki/jurisdiction-exposure)
policy signal within the current Russia, Iran, and North Korea scope. Public
reports expose only country/role counts, never the contributor identity or raw
location. Ambiguous matches do not affect the score, and the service does not
infer nationality, citizenship, sanctions status, intent, or individual
trustworthiness.

## Account data

Signing in uses **GitHub OAuth**. The service stores the GitHub profile
basics needed to operate an account: username, display name, avatar, and
account identifiers, plus the account balance and its transaction history.

A GitHub access token is used at submission time to verify repository
ownership or maintainer permission for paid scans. It is used for that
authorization check and for the account session — not for reading private
repository contents in free public scans.

## Sessions, cookies, and analytics

Authentication uses a signed session cookie. The session data is held in the
cookie and signed by the service; it is not a server-side login record.

The site also uses Google Analytics 4 to understand aggregate use of the
public site. Google receives standard online identifiers and event data
generated when the Analytics tag loads, including page views. Analytics is not
used for advertising, remarketing, or selling personal data. Browser privacy
tools or content blockers may prevent this tag from loading.

## What is deliberately not collected

- No advertising profiles, remarketing audiences, or sale of personal data.
- No email marketing lists harvested from OAuth (email is used for
  transactional and support correspondence, not campaigns, unless
  explicitly requested).
- No private repository contents outside an explicitly commissioned private
  audit — and private audit reports are private to the commissioning
  account.

## Data removal

Account deletion requests are honored via [contact](/contact): account data
and sessions are removed. Published inspection reports of public
repositories are records of public data and remain published — see the
[terms](/terms) on the public record.

## Changes

Material changes to this policy are announced on this page with an updated
date.