Privacy Policy

1. The CLI: Your Code Stays on Your Machine

Thuban is a command-line tool that runs entirely on your local machine. When you run thuban scan, your source code is analysed locally. No source code, file contents, file names, file paths, or project names are ever transmitted to our servers or any third party.

This is a core architectural decision, not a feature we might change. Thuban was designed from the ground up to be local-first.

2. Supply-Chain Lookups (Optional)

Thuban's dependency and supply-chain analysis checks your project's dependency names and versions — never your source code — against public package registries and vulnerability databases:

• npm and the Go proxy — for JavaScript/TypeScript and Go dependency metadata
• PyPI — for Python dependency metadata
• crates.io — for Rust dependency metadata
• OSV (Open Source Vulnerabilities) — for known CVEs affecting your dependencies

Only the package name and version are sent in these lookups. Your source code, file contents, file names, and file paths are never included. Run any scan with --offline to disable supply-chain lookups entirely and stay fully air-gapped.

3. Optional Telemetry

Thuban includes optional, anonymous telemetry that is off by default. You must explicitly opt in by running:

thuban telemetry --on

If you opt in, we collect only the following aggregate data points:

You can opt out at any time by running thuban telemetry --off.

4. The Dashboard

The Thuban dashboard at thuban-alpha.vercel.app is a web application where you can view scan results you choose to push. The dashboard uses Google Analytics to understand how visitors use the site.

A cookie consent banner is shown on first visit. Analytics are only loaded after you accept. If you decline, no tracking cookies are set.

5. Free Trial Signup & Email

We collect your email address to verify your identity, grant access to your free trial, and track usage of the free tier.

With your explicit consent, we may send you product updates and security news. You can unsubscribe at any time.

We do not sell or share your email address with third parties.

When you use Thuban with an active license, we collect anonymous usage telemetry: which commands you run, your Thuban version, and your platform. We do not collect file contents, project names, scan results, or IP addresses. You can opt out by setting THUBAN_NO_TELEMETRY=1.

6. The Website (thuban.dev)

This website uses Google Analytics with cookie consent. We use it to understand which pages are visited and how people find us. No personal data is collected beyond what Google Analytics provides by default (anonymised IP, page views, referrer).

You can decline cookies when prompted, and no tracking will occur.

7. Third-Party Data Sharing

We do not sell, rent, trade, or otherwise share your data with third parties. The only third-party service that receives any data is Google Analytics, and only if you consent to cookies on the website or dashboard.

8. Data Retention

Telemetry data (if opted in) is retained in aggregate form and is not linked to any individual user. We do not maintain user profiles or track individual usage patterns.

If you use the dashboard, scan results you push are stored on your account and can be deleted at any time.

9. Your Rights

Under GDPR and UK data protection law, you have the right to:

• Access any personal data we hold about you
• Request deletion of your data
• Opt out of telemetry at any time
• Decline cookies on the website and dashboard

In practice, if you use the CLI without opting into telemetry, we hold no data about you at all.

10. Changes to This Policy

If we make material changes to this privacy policy, we will update this page and change the effective date. For significant changes, we will also note it in the changelog.