Privacy Policy

Last updated: July 2026

The short version:
Your code never leaves your machine. The only network calls Thuban makes are optional supply-chain lookups — it checks your dependency names against public vulnerability databases, never your source. Use --offline to disable. We collect only what we need to operate the service — your email, payment info, and anonymous usage stats.

1. What Thuban Does

Thuban is a CLI-based code verification tool. It runs entirely on your local machine. Your source code is never uploaded, transmitted, or stored on any Thuban server. All scanning, analysis, and reporting happens locally.

2. What We Collect

We collect the minimum data needed to operate:

Account data: Email address (for license delivery and account management)
Payment data: Processed by Stripe. We never see or store your card number. See Stripe's privacy policy.
License validation: When you run thuban activate, we verify your license key against our server. This transmits only the key itself — no code, no filenames, no scan results.
Supply-chain lookups (optional, on by default): When scanning dependencies, Thuban checks package names and versions from your manifest files (e.g. package.json, requirements.txt, Cargo.toml, go.mod) against public registries (npm, PyPI, crates.io, Go proxy) and the OSV vulnerability database. Only dependency names and versions are sent — never your source code. Run with --offline to disable these lookups entirely.
Anonymous usage telemetry (optional): If you opt in via the dashboard, we collect aggregate scan counts, language distribution, and rule trigger frequency. This contains zero code content.

3. What We Never Collect

Your source code (never transmitted)
File names or directory structures
Scan results or findings
Git history, commit messages, or branch names
Environment variables or secrets

4. Cookies & Analytics

The thuban.dev website uses Google Analytics and may use Meta/LinkedIn tracking pixels for marketing purposes. These are loaded only after you accept cookies via the consent banner. You can decline and use the site normally.

5. Data Storage & Security

Account and license data is stored securely using industry-standard encryption. Payment processing is handled entirely by Stripe (PCI DSS Level 1 certified). We do not store payment card details.

6. Third-Party Services

Stripe — payment processing
SendGrid — transactional email (license delivery)
Vercel — dashboard hosting
Google Analytics — website analytics (consent-based)

7. Data Retention

We retain your account data for as long as your account is active. If you cancel your subscription, we retain your email for 90 days in case you resubscribe, then delete it. You can request immediate deletion at any time.

8. Your Rights

You have the right to:

Access the data we hold about you
Request correction of inaccurate data
Request deletion of your data
Export your data in a portable format
Withdraw consent for analytics tracking

For any privacy request, email privacy@thuban.dev.

9. GDPR & International Users

We comply with GDPR requirements. Our lawful basis for processing is contract performance (delivering your license) and legitimate interest (improving the product via anonymised telemetry). For EU users, data is processed in accordance with applicable EU data protection regulations.

10. Children

Thuban is not directed at children under 16. We do not knowingly collect data from children.

11. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated via email to active subscribers. The "Last updated" date at the top reflects the most recent revision.

12. Contact

For privacy questions or data requests:
privacy@thuban.dev