--- title: "Privacy policy | Harbyn" description: "What personal data Harbyn collects, why, for how long, who processes it, and how to access, export or delete it. Your source code never reaches us." canonical: "https://harbyn.com/privacy" last-updated: 2026-10-25 --- # Privacy policy Markdown version of . Last updated: October 22, 2026 Harbyn is operated by **RC LABS LTDA**, a company registered in Brazil under CNPJ 67.664.885/0001-02, with its office at Rua Prefeito Hugo Cabral, 136, Sala 3, Centro, Londrina - PR, CEP 86020-110, Brazil. RC LABS LTDA is the controller of the personal data described here. Contact for anything in this policy, including requests about your data: [support@harbyn.com](mailto:support@harbyn.com). Security reports: [security@harbyn.com](mailto:security@harbyn.com). ## The short version - Your source code never reaches us. The scanner and the GitHub Action run on your machine or in your CI. - We keep what an account needs: your email, your name, how you sign in, your settings, and the repositories you choose to connect. No selling or renting of data. - Advertising measurement with Meta happens only if you accept advertising cookies on harbyn.com, and you can withdraw at any time. Nothing of it runs in the dashboard, the CLI or the GitHub Action. - You can download everything we hold about you, and delete your account, from Settings > Your data. ## What we collect, and why | Data | Why | How long | | --- | --- | --- | | Email, name, profile picture URL (from GitHub or Google if you sign in with them) | Your account; account and alert emails | Until you delete the account | | Password (as a salted hash), two-factor secret and backup codes, if you set them | Signing in securely | Until you remove them or delete the account | | Sessions: sign-in time, IP address, browser user agent | Keeping you signed in; showing and revoking your devices | 14 days per session | | Sign-in links (email verification, password reset) | Proving you own the address | 24 hours / 30 minutes, single use | | Watched vendors, alert and Radar email settings, alert history (which change, when it was sent) | Sending the alerts you asked for, once | Settings until you change them; history 1 year | | Alert channels you add (Slack, Discord, Telegram, webhooks): label and status; the destination is encrypted at rest | Delivering alerts where you asked | Until you remove the channel | | Repositories you connect: owner/name, GitHub repository id, default branch | Showing your scans | Until you disconnect | | Scan results your GitHub Action uploads, only if you turn uploads on: commit, run link, files scanned, vendors used, and which change events matched (feed terms and counts). Never paths, lines or code | Your dashboard | 90 days, and at most the last 20 scans per repository | | Dependency list, only if you also turn the inventory on: public package names and versions | Matching your dependencies to vendor changes and known vulnerabilities | Replaced on every upload; deleted with the repository | | Plan and billing status (Stripe customer and subscription ids, plan, period) | Giving you the plan you pay for | While the account exists | | Advertising consent and attribution, only if you accepted advertising cookies on harbyn.com before signing up: when you consented, Meta's click and browser ids (fbc, fbp), campaign parameters (UTM values and the ad's campaign, ad set and ad ids), and your browser's user agent | Telling Meta that a sign-up or a first payment came from one of our ads | 90 days from your consent; deleted at once when you withdraw or delete the account | | Conversions reported to Meta: the event (sign-up or payment) and when | Never reporting the same one twice | 90 days | | Operational logs, kept on our own servers: scrubbed error messages and counts, never emails, credentials, cookies or request bodies | Keeping the service running | 30 days | We do not collect anything from your repositories beyond what the Action uploads with your explicit opt-in, and the Action prints the exact upload in your job summary before sending it. ## Who processes data for us | Provider | What it does | What it receives | | --- | --- | --- | | Locaweb (Locaweb Serviços de Internet S/A), Brazil | Hosting our servers and database, on a virtual private server in Brazil | Everything stored above | | Cloudflare | DNS, network protection and content delivery in front of our sites; storage of our daily database backups (R2, which encrypts stored data) | Requests to our sites; database backups | | Resend | Sending emails | Your email address and the email content | | Stripe | Payments, invoices and tax ids; card details go to Stripe only | Your email, user id, and what you enter at checkout | | GitHub, Google | Sign-in, if you choose them; listing your repositories when you connect one | What you authorise on their screens | | Slack, Discord, Telegram, your webhooks | Alert delivery, only to destinations you add | The alert content | | Meta (Meta Platforms Ireland Ltd. and Meta Platforms, Inc.) | Advertising measurement, only with your consent (see Advertising measurement below). For what its Pixel collects in your browser, Meta acts as an independent controller under its own terms | From your browser, after you accept: the harbyn.com pages you visit, the events listed below, its cookies, and what any browser request carries (IP address, browser details). From our server, after a confirmed sign-up or your first successful payment: the event, its time, an anonymous event id, fbc, fbp, your browser's user agent, and for a payment its amount and currency | | npm, PyPI, OSV | Package and vulnerability lookups | Public package names and versions only, never your account | Our servers and database are in Brazil. Some of these providers process data outside Brazil (mainly in the United States and the European Union). We use them under their data processing terms, which provide the safeguards the LGPD (art. 33) and the GDPR require for international transfers. The open-source scanner can also call an AI model provider you choose (Anthropic, OpenAI or OpenRouter), with your own key, from your own CI, to propose fixes. That call never passes through us, and we never see your key or code. ## Advertising measurement We run ads, and we want to know which of them bring people who sign up and pay. We measure that with Meta, only if you say yes. - **On harbyn.com only.** The banner asks before anything loads; Accept and Reject are the same size, and "Cookie settings" at the bottom of every page changes your choice. Until you accept, no Meta script is requested. If your browser sends Global Privacy Control, we treat it as a reject. - **After you accept,** Meta's Pixel runs on harbyn.com and reports page views, views of the pricing page, clicks on a sign-up button, and copies of the scan command, never the text of what you clicked or copied. We turned off its automatic collection of buttons and page details, and we do not give it your email or any other identifier. - **If you then sign up,** the consent and Meta's ids travel with you in two first-party cookies (harbyn\_consent, harbyn\_ad) and are kept with your account (see the table above). When your address is confirmed, and when your first payment succeeds with an amount above zero, our server tells Meta through its Conversions API: the event, its time, an anonymous event id, Meta's click and browser ids, your browser's user agent, and for a payment its amount and currency. Never your email or name (in clear or hashed), your IP address, our ids, your repositories, scan results, or any token. Free trials, renewals and failed payments are not reported. - **To withdraw,** open Cookie settings and choose Reject: the Pixel stops, its cookies (\_fbp, \_fbc) and ours (harbyn\_ad) are deleted, and if you are signed in, the consent stored with your account is deleted too. You can also write to [support@harbyn.com](mailto:support@harbyn.com). Withdrawing does not undo what was already sent; Meta keeps it under its own terms. - **Not in the product.** The dashboard (app.harbyn.com), the API, the CLI, the GitHub Action and the MCP servers load no advertising code. The CLI and the Action still send nothing unless you turn uploads on. ## Cookies and local storage In the dashboard, only what the service needs: the session cookie (keeps you signed in; secure, HTTP-only), short-lived cookies during GitHub and Slack connections (10 minutes), and your theme and sidebar choice, kept in your browser. On harbyn.com: your cookie choice (harbyn\_consent, 180 days) and your theme, and only after you accept advertising cookies, Meta's \_fbp and \_fbc (set by Meta, up to 90 days) and our harbyn\_ad (30 days), described in Advertising measurement. No analytics. ## Legal bases Performing our contract with you (your account, alerts, connections and plan); legitimate interests (security, fraud prevention, keeping the service running, which is why logs are scrubbed and short-lived); legal obligations (billing and tax records, kept by Stripe for as long as tax law requires); and your consent where we ask for it (optional uploads, the dependency inventory, optional alert channels, advertising measurement), which you can withdraw at any time. ## Your rights Under the LGPD (art. 18) and, where it applies, the GDPR, you can: confirm and access the data we hold (Settings > Your data > Download), correct it (Settings), delete it (Settings > Your data > Delete your account), take it to another service (the same download, as JSON), learn who we share it with (above), withdraw consent, and object. For anything else write to [support@harbyn.com](mailto:support@harbyn.com); we answer within 15 days. You can also complain to the ANPD (Brazil) or your local data protection authority. When you delete your account, everything above is deleted at once and any paid plan is cancelled. Database backups that still contain it expire within 14 days. Invoices stay with Stripe as tax law requires. ## Security Row-level security in the database so one account can never read another's data, encryption of alert channel destinations and secrets at rest, two-factor authentication, signed and verified change feed, and an incident process that tells affected users quickly. To report a vulnerability, write to [security@harbyn.com](mailto:security@harbyn.com) (also listed in [harbyn.com/.well-known/security.txt](https://harbyn.com/.well-known/security.txt)). ## Children Harbyn is a tool for software teams and is not meant for anyone under 18. ## Changes We will update this page when what we do changes, and email account holders about material changes before they take effect.