Privacy Policy

Website analytics: Vercel Analytics is used for privacy-respecting page view tracking without cookies. We also use Google Analytics (GA4) for aggregate usage data — page views, referrers, device type, and countries. Google Analytics cookies are only set with your consent. No advertising features or cross-site tracking are enabled. No individual user profiles are built.

CLI tool: Zero telemetry. The Sigil CLI does not phone home, does not report scan results, and does not collect usage data of any kind. It is open source — verify this yourself at github.com/NOMARJ/sigil.

Pro and Team accounts: We collect your email address and billing information. Billing is processed by Stripe — we do not store payment card numbers.

Data sources: Public package registries (PyPI, npm, ClawHub), public GitHub repositories and profiles.

Purpose: Security transparency — enabling developers to assess risk before installing packages.

Data minimisation: Only public data is collected. No unnecessary personal data is stored. Author names and handles are sourced directly from public registries.

Analytics data is used in aggregate to understand which content is useful and how the site performs. We do not build individual profiles.

Account email addresses are used for product updates, billing receipts, and support. We do not sell, share, or rent email addresses to third parties.

Package author data from public registries is used solely to provide provenance context in scan reports.

Under applicable data protection laws (including the Australian Privacy Act 1988 and GDPR), you have the right to:

• —Access data held about you
• —Object to processing of your data
• —Request removal of your data from scan reports
• —Request deletion of your account and associated data

Scan results: Retained indefinitely as part of the public scan database.

Personal data: Removed within 30 days on valid request. Contact security@sigilsec.ai.

We use Google Analytics (GA4) to understand how visitors use the site. Google Analytics sets cookies (_ga, _ga_GGXK0RK8R8) only after you consent via the cookie banner. IP addresses are anonymised by default. We do not enable advertising features or cross-site tracking.

We also use Vercel Analytics, which does not use cookies and collects no personally identifiable information.

For full details, see our Cookie Policy.