Privacy

The short version

There are no user accounts, no cookies for ordinary visitors, no analytics scripts, no advertising, and no third-party trackers. Nothing you type is stored against you. The only personal data this service holds is the IP address in its server logs.

What is collected

• Server logs. Your IP address, the page requested, the time, the response status, and your browser's user-agent string. These exist to keep the service running and to investigate abuse and security incidents. They are also retained because the CERT-In Directions of 2022 require log retention for 180 days.
• Repository names you look up. Stored as part of the scan results — the analysis of a public repository, with no record of who requested it. There is nothing in that database linking a scan to a person or an IP address.
• An administrator cookie, set only if you sign in to the internal admin area. Ordinary visitors are never issued a cookie by this site — though Razorpay may set one of its own on the donate page.

What is not collected

• No name, email address, or phone number — there is nothing to sign up for.
• No analytics, fingerprinting, session recording, or advertising identifiers.
• No access to your code. Only public repositories are read, from GitHub.
• No payment information. Donations are processed entirely by Razorpay — card, UPI, and bank details are entered on Razorpay's checkout and never reach this server, which receives only a payment reference to confirm the payment succeeded.

If you donate

Donations are handled by Razorpay Software Private Limited, who become the data fiduciary for what you enter on their checkout — name, contact details, and payment instrument. Their privacy policy governs that. Reporight receives an order id, a payment id, and the amount, which are used only to confirm the payment and to answer a refund request. No payment method is stored here, and nothing is charged again.

Who your data reaches

When you look up a repository, this server — not your browser — contacts GitHub's API and archive service on your behalf. GitHub sees the server's address, not yours. Your browser makes no requests to any third party while using this site.

The one exception is the donate page, which loads Razorpay's payment button script from checkout.razorpay.com. On that page — and only that page — your browser contacts Razorpay directly, and Razorpay may set its own cookies as part of taking the payment. Every other page contacts nobody.

The site is hosted on a virtual server; the hosting provider processes the traffic necessary to deliver it.

How long it is kept

• Server logs: 180 days, then deleted.
• Scan results: 90 days, and no more than the most recent 2,000 scans.
• The administrator session: 12 hours.

Your rights

Under the Digital Personal Data Protection Act, 2023 you may ask what personal data is held about you, ask for it to be corrected or erased, and complain about how it is handled. In practice the only such data here is an IP address in a log file; tell us roughly when you visited and we will search for and delete those entries, unless a retention obligation requires us to keep them.

Write to the grievance officer below. If you are not satisfied, you may complain to the Data Protection Board of India.

Security

The site is served over HTTPS. The application stores no credentials, takes no uploads, and runs with restricted filesystem access. If we become aware of a personal data breach we will notify affected people and the Data Protection Board, and report qualifying incidents to CERT-In within six hours as required.

Complaints

Complaints about this service — including anything you believe is wrong, unlawful, or infringing — reach a person directly, who will acknowledge within 24 hours and resolve within 15 days.

Contact