Privacy policy

Controller

The controller is the publisher named in the legal notice, TODO: publisher full name, reachable at TODO: contact email address.

Web server access log

The nginx server that delivers the pages writes one line per request to its standard access log, which goes to the container output.

Data

IP address, date and time, requested address (including a search typed in the address bar as ?q=), response status and size, referring page, browser user agent, forwarded-for header

Purpose

Running the site, diagnosing errors, detecting and stopping abuse

Legal basis

Legitimate interest (GDPR art. 6(1)(f))

Retention

TODO: how long the nginx access log written to the container output is kept

Reverse proxy access log

Requests to the site and to its search API pass through a reverse proxy at the host, which keeps its own access log with the same kind of data.

Proxy and retention

TODO: name of the reverse proxy in front of the site and API, and how long its access log is kept

Purpose

Routing requests, diagnosing errors, detecting and stopping abuse

Legal basis

Legitimate interest (GDPR art. 6(1)(f))

Search rate limiting

To keep the search usable for everyone, the API allows a fixed number of searches per minute from each IP address. The API itself writes no request log.

Data

IP address and a counter of recent searches, held in memory only

Purpose

Preventing one client from exhausting the search

Legal basis

Legitimate interest (GDPR art. 6(1)(f))

Retention

Removed at the next hourly cleanup once it no longer counts toward the limit, and at every restart. Never written to disk.

Search queries

What you type in the search box is sent to the API, which first interprets it with a model running on its own server. When that finds no tool to replace, the text of the query, and nothing else (no IP address, no identifier), is sent to Jev at api.typesafe.ai, a language model service that turns it into filters. Avoid typing personal information in the search box.

Data

The query text

Purpose

Answering the search you asked for

Legal basis

Legitimate interest (GDPR art. 6(1)(f))

Retention

Queries interpreted by Jev are cached in the API's memory with their result, without any link to who sent them, for at most 24 hours. The cache is also emptied every time the catalog is refreshed, hourly, and at every restart. Never written to disk.

Recipient

TODO: legal name and address of the company operating Jev at api.typesafe.ai

Where

TODO: country where Jev processes queries, and the transfer safeguard if it is outside the EU

Its terms

TODO: link to the Jev privacy policy or data processing terms

The search also puts your query in the page address (?q=) so the results can be shared. It stays in your browser history, and reaches the access logs above when that address is loaded.

Repository details

The API fetches each listed project's README from GitHub and its security report from OpenSSF Scorecard itself, server to server, and keeps them for 12 hours. Those requests carry only the repository name, nothing about you.

A tool page opens on that project's README. Its images and badges are loaded by your browser from where the project hosts them: GitHub (raw.githubusercontent.com, camo.githubusercontent.com) and, for some READMEs, badge services such as shields.io. Those hosts receive your IP address and browser details like any image request, and their own policies apply. No other page loads anything from them.

Who receives the data

The publisher, the host listed in the legal notice as it runs the servers, and, for search queries only, the operator of Jev. Nothing is sold or shared for advertising. Links to GitHub and to the listed projects are plain links: once you follow one, that site's own policy applies.

Your rights

Under the GDPR you can ask to access, correct or erase data about you, to restrict its processing, and you can object to processing based on legitimate interest. Write to TODO: contact email address. The logs are not tied to a name, so give the IP address and the approximate time of your visit so the matching entries can be found.

If you think your data is mishandled, you can complain to the French data protection authority, the CNIL.