How we collect, use, and protect your data
Last updated: October 24, 2026
DevUpdate.io ("we," "us," or "our") operates devupdate.io. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our dependency tracking service. We are committed to protecting your privacy and handling your data in accordance with GDPR and other applicable data protection laws.
When you create an account, we collect or derive:
@, and you can change it at any time in Settings. It is a display and sign-in handle only.utm_source, utm_medium, utm_campaign, utm_term, utm_content) and one ad-network click identifier if present. We keep the landing path and the referrer host only, never full URLs, which can carry another site's session tokens or your email address. Used to understand which channels bring developers to DevUpdate.io, never sold to anyone, and deleted with your account. One narrow exception, and only with your consent: if you reached us by clicking a LinkedIn ad, we report back to LinkedIn that the click led to a signup. See LinkedIn conversion measurement below.When you add tracked sources to monitor:
Our AI analysis generates and stores:
When you upload lockfiles:
For security and functionality:
When you subscribe to a paid plan or use AI-powered features:
If you use the programmatic-access features:
When you create or join a team, we collect:
We use your information to:
We use the following third-party services to operate DevUpdate.io:
We use PostHog for product analytics. PostHog helps us understand how you use DevUpdate.io so we can improve your experience. All analytics data is hosted on PostHog's EU servers (eu.posthog.com) and is never shared with third parties or used for advertising. Events are pseudonymized by your account identifier rather than fully anonymized, meaning we can correlate events back to your account internally, but the data is never shared externally. Your email address and username are not sent to PostHog. Events include page views, feature interactions, and session information. Page addresses are filtered before they leave your browser: campaign parameters and ad-click identifiers are kept, everything else in a query string is dropped, and the one-time token in a password-reset, email-verification, email-change, account-deletion, team-invite or share link is removed with it, so those tokens never reach PostHog. Clicks on buttons and links are recorded with their text and attributes, link address included, and those of the elements around them, except on any button or link that names one of your repositories (its owner and name, or a GitHub link to it): clicks on those are not recorded at all. Any other element that shows a repository in what a click records is marked as such in our code, and its text and attributes are removed in your browser before the click is sent, as is a link to an account or repository on GitHub, GitLab, Bitbucket, Codeberg, SourceHut or Gitee anywhere in it, and most other text shaped like a repository's owner and name (the word pairs our own pages use, such as “CI/CD”, and media types such as image/webp are kept). Session recording: only after you accept analytics in the cookie banner, your browser starts a PostHog session recording of the pages you visit, which keeps their layout, your clicks and your navigation. Every piece of page text and every input value is masked in your browser before it is recorded, as are text attributes such as tooltips and image descriptions, and GitHub account and repository names are removed from link and image addresses. The page addresses and request addresses a recording keeps are filtered like those on every event, so no one-time token in a link is recorded. Whether a recording runs at all also depends on our PostHog project's recording setting. Withdrawing consent in the banner stops a recording in progress. Analytics captured in your browser require your consent and you can opt out at any time via the cookie banner. Separately, a small number of events are recorded on our own servers rather than in your browser: that your account was created, that a lockfile was added, that a digest email was sent, and that an AI agent invoked the MCP tools. These set no cookies and read nothing from your device, carry your pseudonymous account identifier (plus, on the signup event only, the campaign label described under Account Information above), and are processed as operational product analytics under our legitimate interest in knowing whether the product works. Deleting your account does not delete your PostHog profile today: PostHog keeps the account identifier and the events attached to it, which no longer match anything we hold, under the data retention of our PostHog project. To have it removed as well, email us from your account address before you delete the account; once the account is gone we can no longer tell which profile was yours. PostHog's data processing is governed by their Privacy Policy.
Only if you arrived by clicking one of our LinkedIn ads and accepted the cookie banner: when you create an account, our server sends LinkedIn its own click identifier back, so LinkedIn can tell us the ad worked. No LinkedIn code runs on this site, and your email address is never sent, not even hashed. Full detail, including what we deliberately withhold, is under LinkedIn conversion measurement in the Cookies section below. LinkedIn's data processing is governed by their Privacy Policy.
We send git diffs, release notes, README and page excerpts, and similar publicly available content to OpenAI's API for analysis and summary generation. We may engage other LLM providers in the future; if we do, we will update this policy and, where required by law, notify affected users before the change takes effect. OpenAI's data processing is governed by their Privacy Policy.
Public data ingestion: We fetch public repository data (releases, diffs, and README excerpts) via GitHub's API.
Sign-in (DevUpdate.io GitHub App): If you sign in with GitHub, the DevUpdate.io GitHub App requests read-only access to your email addresses and to the contents and metadata of repositories you select, never write access. The consent screen explicitly lists those permissions. We receive your GitHub email address, username, and avatar URL, and a short-lived user-to-server access token (plus refresh token) we use to call GitHub on your behalf.
GitHub App install (required for private repos): Authorizing the App at sign-in is enough for public-repo features. To use private-repo features (private starred sync, private-repo source tracking, live lockfile sync from a private repo), install the same App on the owning user account or org and pick which repos it can see. The App stays read-only (contents + metadata only) regardless of which repos you grant. We use it to periodically fetch connected lockfile contents and run dependency change-detection. We store only the parsed dependency list (package names and versions), not the raw lockfile or any other repository contents. You control this access and can revoke or change install scope at any time from your GitHub settings.
GitHub starred-repository sync (optional): If you enable this feature, we store your GitHub username and periodically fetch your public starred repositories via GitHub's public API (/users/{username}/starred). We use the resulting repository URLs to create tracked sources on your behalf, and we deactivate tracked sources that you originally added through this feature when you un-star the corresponding repository. We do not access private stars, and we do not access any data beyond the public star list itself. You control the username and can clear it from your settings at any time.
When you track a VS Code extension, we make read-only requests to the public Visual Studio Marketplace and Open VSX Registry APIs to retrieve the extension's version history and changelogs. We send no authentication and access no editor, workspace, or account data. Extension metadata and changelog excerpts are publicly available content and are handled the same way as other non-GitHub release pages, including being sent to our AI provider for summary generation.
If you sign in with Google, we receive your Google account email, name, and profile picture. We request only the minimum OAuth scopes (openid, email, profile) needed for sign-in.
DevUpdate.io runs on Railway: the website, the application server, the scheduled jobs, the PostgreSQL database that holds your account data, and the Redis cache. All of them run in Railway's EU West region, in the Netherlands. Railway's data processing is governed by their Privacy Policy.
We use two AWS services. Neither hosts the application or its database.
AWS's data processing is governed by their Privacy Notice.
We use PayPro Global as our Merchant of Record for payment processing. When you subscribe to a paid plan, PayPro Global collects and processes:
PayPro Global handles all payment compliance, including VAT/sales tax calculation and collection. We receive webhook notifications about subscription events (creation, renewal, cancellation) but do not store your payment card details. PayPro Global's data processing is governed by their Privacy Policy.
When you create or join a team subscription, certain information is shared with other team members to enable collaboration and team management.
All team members (including regular members) can see:
Team admins and owners have additional visibility into:
Your personal data remains private. Team members cannot see:
Important: By accepting a team invitation, you consent to sharing your username and email address with other team members. If you do not wish to share this information with the team, you should decline the invitation. You can leave a team at any time from your team settings, which will immediately stop sharing your information with team members.
You can create a link that lets anyone view a single release summary without a DevUpdate.io account. This is an action you choose to take: no release summary is made public unless you generate a link for it.
We use cookies for essential functionality and analytics (with your consent):
du_consent): Remembers your cookie consent choice: only which button you pressed (accepted or rejected), kept for six months, plus a copy in your browser's local storage. The cookie exists so our own backend can see your answer, which it needs in order to honor a rejection server-side; local storage alone is not readable there. It is written whichever way you answer, because the record of a choice is not a use of it. That is also why it is essential rather than optional.When you're signed in, we maintain a persistent server-sent-events connection from your browser to deliver live updates (subscription status, release announcements). This stream uses the same NextAuth session token as the rest of the site; no additional cookies are introduced. Public source pages in the explorer also open a persistent connection while you view them, whether or not you are signed in, so new releases appear without a reload. That connection is not tied to your account, sends no token, and sets no cookies.
With your consent, we use PostHog for analytics to understand how you use our service and improve your experience:
utm_*) and ad-click identifiers present on the link you arrived throughdu_attr): set when you arrive from a campaign link or another website, so that the origin recorded on your account is the page you actually landed on rather than whatever page you happened to be on when you signed up. It contains only the campaign parameters, the ad-network click identifier if the link carried one, the referring hostname and the landing path described under Account Information, expires after 30 days, and is HttpOnly, so no script on the page can read it. It is not set if you arrive directly. This is the one non-essential cookie we set before you answer the banner. Block cookies for this site if you would rather it were not set; nothing in the product depends on it.Your Choice: You can accept or reject analytics cookies via the cookie banner. You can change your preference at any time by clearing your browser's local storage or contacting us at info@devupdate.io. Rejecting analytics cookies will not affect core functionality.
We do not use advertising cookies, ad-network pixels or third-party tracking scripts. There is no LinkedIn Insight Tag, no Meta pixel and no Google Ads tag on this site, and nothing of the sort runs anywhere inside the signed-in app. We do not sell your personal data, to advertisers or to anyone else.
We advertise on LinkedIn, and we need to know whether those ads work. When you click one of our LinkedIn ads, LinkedIn adds its own click identifier (li_fat_id) to the link. If you then create an account and you accepted the cookie banner, our server tells LinkedIn that this click resulted in a signup.
This happens server to server. No LinkedIn code runs in your browser and no ad-network cookie is set. It reads two records already described above: the du_attr attribution cookie, and the du_consent record of how you answered the banner.
We retain your data for as long as your account is active. When you delete your account:
Temporary tokens (email verification, password reset) are automatically deleted upon expiration or use.
Unverified accounts: Accounts created with email and password that do not complete email verification within 7 days of signup are automatically deleted. We send a reminder email around day 4 of that window. During this window we store only the email address, the username derived from it, the password hash, and a hashed verification token. No other personal data is collected before verification.
Inactive verified accounts: Verified free-tier accounts that have never added a tracked source and never connected a lockfile are automatically deleted 30 days after signup. We send up to five reminder emails over the preceding 27 days, the last of which is an explicit deletion warning. Accounts on a paid subscription and accounts that have joined a team are excluded from this sweep. After deletion we send a final notification email to the address on file, and the row is removed from production storage along with sessions and OAuth links.
Billing-record retention obligation: The payment notifications our payment provider PayPro sends us for each order and subscription change (stored as our order and subscription-event records) are booking vouchers under German commercial and tax law (§147 AO, §257 HGB). We keep them for 8 years, counted from the end of the calendar year in which they arrived, and delete them automatically once that period has ended. A subscription's records are never deleted while it is still running, however old they are (a cancellation still running to the end of its paid period counts), because renewals and refunds rest on its first order. Once it has ended, the 8 years count from the end of the calendar year of the last change we recorded on it, normally the year it ended, when that is later than the year a record arrived. Deleting your account does not remove them earlier. Subscription history and withdrawal-waiver consent are stored on the subscription record itself, which is kept while the subscription is running and, once it has ended, for 10 years, counted from the end of the calendar year of the last change we recorded on the subscription (normally the year it ended); a daily sweep then deletes it. Deleting your account neither shortens nor extends that period. The record of a paid team's handover is kept with the record of the subscription the team moved away from, and deleted with it; deleting either account unlinks it from the record rather than removing it. These retained records are reduced to the minimum required by law and contain no source data, no analysis output, no signup attribution, and no profile data beyond what the invoice and audit trail require.
Security audit log: Entries recording security events on your account (sign-ins, sign-outs, password changes and resets, AI-client authorizations) keep their timestamp after the account is deleted, so a past incident can still be investigated, and their IP address and browser user agent for 90 days from the event, after which a daily sweep clears them. Deleting your account unlinks them from it, and none of them holds an email address. The entry recording an account's deletion keeps only the time and the address's domain: no account number, IP address or user agent.
Under GDPR and other data protection laws, you have the following rights:
To exercise these rights, contact us at info@devupdate.io.
We implement industry-standard security measures:
While we take reasonable measures to protect your data, no internet transmission is 100% secure. We cannot guarantee absolute security.
Our application, database and cache run in Railway's EU West region (the Netherlands), email is sent through Amazon SES in Frankfurt, and analytics are stored on PostHog's EU servers. Railway and AWS are companies based in the United States, and OpenAI processes the content we send it in the United States, so your data may be transferred to or accessed from countries outside the European Economic Area (EEA). These transfers are protected by appropriate safeguards such as Standard Contractual Clauses and compliance with GDPR requirements.
DevUpdate.io is not intended for users under 16 years of age. We do not knowingly collect personal information from children. If you believe we have collected data from a child, please contact us immediately.
We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. Continued use of DevUpdate.io after changes constitutes acceptance of the updated policy.
If you have questions about this Privacy Policy or how we handle your data, contact us: