DepsGuard Privacy Policy

Last updated: March 25, 2026

DepsGuard is developed by Techtix ("we", "us", "our"). This privacy policy explains what data the DepsGuard browser extension and associated API collect, how it is used, and your rights regarding that data.

Data We Collect

Package Names and Versions

When you add a package to your watchlist or trigger a scan, the package name, registry (PyPI/npm), and version string are sent to the DepsGuard API to query security advisory databases. This is the only data transmitted from your browser to our servers.

Scan File Contents

When you paste or upload a dependency file (requirements.txt, package.json, etc.) for bulk scanning, the file contents are sent to the DepsGuard API, parsed for package names and versions, and then discarded. File contents are not stored on our servers.

Anonymous Usage Metrics

We collect aggregate, non-personally-identifiable metrics such as total scan counts and advisory lookup volume for service reliability monitoring. No individual user actions are tracked.

Data We Do NOT Collect

  • Browsing history — DepsGuard does not track, record, or transmit any browsing activity beyond the package registry pages where content scripts are active.
  • Personal information — No names, email addresses, IP addresses, or device identifiers are collected by the extension.
  • Cookies or tracking pixels — DepsGuard does not set cookies or use any tracking technology.
  • Source code — Your project source code is never accessed or transmitted.

Third-Party Services

DepsGuard queries the following external security databases server-side (from our API, not from your browser):

  • GitHub Security Advisory Database (GHSA) — queried for known vulnerabilities in npm and PyPI packages.
  • OSV.dev — queried for cross-ecosystem vulnerability data maintained by Google.

These services receive only package names and version ranges as part of standard API queries. No user data is shared with these services.

Data Retention

  • Watchlist data is stored locally in your browser via the Chrome storage API. It is never uploaded unless you explicitly trigger a status check.
  • Advisory data fetched from GHSA and OSV is cached on our API server for up to 24 hours, then refreshed.
  • Scan results are ephemeral — computed on request and not persisted beyond the API response.

Data Security

All communication between the extension and the DepsGuard API is encrypted via HTTPS/TLS. The API server does not store personal data. Advisory cache data is stored in a PostgreSQL database with standard access controls.

Your Rights

  • Delete your watchlist at any time by removing packages from the extension or uninstalling it.
  • Opt out of all data collection by uninstalling the DepsGuard extension.
  • Request information about any data associated with your usage by contacting us.

Changes to This Policy

We may update this privacy policy from time to time. Changes will be posted at depsguard.tech-tix.com/privacy with an updated date.

Contact

For privacy-related questions or concerns:

← Back to DepsGuard