# Dependency Radar Privacy Notice

Notice version: 1.1.
Effective date: 2026-10-09.
Last updated: 2026-10-09.

## 1. Data Controller

Dependency Radar, plugin identifier `io.dependencyradar` (the "Plugin"), is provided by Nikita Kryukov, operating under the brand if-else.dev (the "Provider"). Contact: hello@if-else.dev. Where the Provider determines the purposes and means of processing personal data, the Provider is the data controller for that processing. Providing the Plugin does not by itself make the Provider the controller of all information in your projects or held by external services; the applicable roles depend on the processing involved.

## 2. Scope and data processing

This notice describes data handling in the free beta implementation reviewed on the date above, including local analysis and operations performed through your configured tools.

This notice covers the Plugin's own processing. Your IDE, JetBrains Marketplace, package managers, registries, repository hosts and other tools or services have their own data practices. Visiting the website or contacting support is separate from running the Plugin. This notice does not change the [End User License Agreement](https://if-else.dev/projects/dependency-radar/eula/) or itself constitute consent to processing.

The Plugin reads project directories, package manifests and lockfiles to discover projects, compare dependency versions and build dependency graphs. It processes paths, file timestamps and sizes, package names and versions, dependency declarations, workspace and linked-package information, package-manager and Node runtime configuration, Git branch names and working-tree status. Discovery can include related Git worktrees outside the selected root directory, subject to configured exclusions. A configured search provider may inspect other files beneath the discovered project directories; its scope depends on the provider and arguments you configure.

This information is used to display dependency relationships and publication status and to prepare project actions. Configured actions can substitute project names and paths, package versions, branch names and user-supplied arguments into command arguments. Settings and retention are described in section 6.

Paths, branch names, package metadata, command text and output can contain personal or confidential information, depending on your projects and configuration.

## 3. Network communications and third-party services

The Plugin invokes your configured package manager, including npm, Yarn, pnpm or Bun as applicable, to query whether a package name and version have been published. For projects identified as publishable, this check may run automatically when the project view is initialized or refreshed, including refreshes following relevant file changes. These requests do not require you to start a publication or confirm each request. The registry communications described here are performed by external tools invoked by the Plugin, rather than a built-in HTTP registry client.

Package-manager requests use the registry selected from project, user or environment configuration, or the tool's default registry. Public and private registries may receive package identifiers, version information, authentication information and request metadata such as a source IP address or tool identification. Installing dependencies may request additional packages. Publishing sends the package contents and metadata selected by the package manager and its configuration.

The Plugin's built-in Git inspection reads local status, branch references and worktree information. Configured commands, Git or package-manager hooks, and runtime-manager tools can also communicate with repository hosts, third-party APIs or other services and transmit data according to their behavior. For example, a configured Git command that contacts a remote may transmit repository content, references or authentication information. The Plugin has no built-in GitHub or GitLab API client. The recipients, transmission details, server location and server-side retention depend on the tools, destinations and services involved. Those services may process information outside your country; this notice does not assert a particular transfer destination or safeguard. Consult the relevant service providers' privacy terms for their processing.

## 4. Authentication and credentials

Operations use permissions and configuration available in your local environment. Processes launched by the Plugin receive environment variables available through the IDE or its configured command-line integration, together with operation-specific overrides; those variables can contain credentials and other sensitive values. External tools may also use credentials from their own configuration or credential helpers. When preparing certain Yarn registry operations, the Plugin reads matching npm authentication tokens from npm configuration and passes them to the package-manager process as `YARN_NPM_AUTH_TOKEN`. Reading registry configuration can include project or ancestor `.npmrc` files, user npm configuration, a user configuration path supplied through `NPM_CONFIG_USERCONFIG`, and configured environment values; Yarn registry selection also considers `.yarnrc.yml`.

The Plugin does not implement a separate credential vault. Values included in saved action definitions are ordinary IDE settings, not a dedicated secret store. External commands may print credentials or sensitive data, and the Plugin does not implement general secret redaction for their output. The absence of a dedicated vault does not mean credentials are never read or passed to tools. Security precautions are described in section 7.

## 5. Telemetry and diagnostics

Command output, errors and operation results may appear in the local operation journal, publication-status diagnostics or IDE notifications. The Plugin's notification group is configured to log notifications in the IDE. Some failures are also recorded through IDE logging, so IDE diagnostic or notification records may contain paths, exception details, command text or output. Journal text, package versions and branch names can be copied to the clipboard when you use the corresponding copy actions.

The beta implementation described here contains no Plugin-operated analytics, telemetry uploader, automatic crash-report submission or built-in integration that sends project data or credentials to a Provider-operated backend. This describes the Plugin's implementation; it does not describe reporting, synchronization or network behavior of the IDE, external tools, configured commands or services. Diagnostics that you choose to copy or submit leave the local environment through the channel you select.

## 6. Local storage and data retention

Project paths, exclusions, discovery and search settings, action definitions and other preferences are saved by the IDE as application settings in `dependency-radar.xml`. Its location and any IDE settings synchronization depend on your IDE configuration. Scan caches, view state, operation journals and publication-session state are held in memory; the Plugin does not implement a persistent scan or journal database. In-memory state lasts while the relevant Plugin objects are active and is not a secure-erasure guarantee.

Project operations can write package manifests and other project files or create Git branches and worktrees. Manifest updates use a temporary file in the project directory and attempt to remove it after the write; interrupted execution may leave temporary material. These operations, external-tool caches, registry publications, IDE logs and notification records have lifetimes distinct from in-memory Plugin state.

Saved settings, IDE records, tool caches, credentials stored by external tools and project files are retained according to those systems and your actions. The Plugin sets no automatic deletion period for those persisted materials, and uninstalling it does not guarantee their removal or reverse completed project operations. Copies you make or share, including clipboard copies, have their own lifetime. Retention of information received by registries and other external services is determined by those services.

## 7. Security

The Plugin uses the access rights of the IDE and invoked tools. It does not provide an independent sandbox for configured commands, dedicated encrypted storage for saved command values, or general secret redaction of command output. Network transport and credential protection depend on the configured tools and destinations; the Plugin does not independently enforce HTTPS for registry URLs.

Protect your operating-system and IDE accounts, review configured commands and registry destinations, and use credentials with permissions appropriate to the operation. Avoid placing secrets in saved commands, and review diagnostics before copying or sharing them. These precautions do not imply that all project information stays local or that every operation is separately authorized by a prompt.

## 8. Legal basis, controls and user rights

Where data-protection law applies, processing personal data requires a valid legal basis. The applicable basis and controller responsibilities depend on the purpose and circumstances of the processing, including your organization's use and the external services involved. This notice describes technical behavior; installation, acceptance of the EULA or publication of this notice does not by itself establish consent or a legal basis for every processing operation.

You can change the project root, exclusions, search provider, configured actions and tool or registry configuration. Review publication destinations and package contents, use credentials with suitable permissions, and remove sensitive values from saved commands and shared diagnostics. The publication confirmation setting concerns publication actions; it does not turn off automatic publication-status requests. The Plugin has no separate setting to disable those requests. Once disabling or uninstalling the Plugin takes effect in your IDE, it stops future Plugin execution, without undoing previously completed operations or deleting information already held elsewhere.

You control the project files and local settings in your environment. If the General Data Protection Regulation (GDPR) applies, you may have rights of access, rectification, erasure, restriction, objection and data portability, subject to its conditions. Where processing is based on consent, you may withdraw it without affecting the lawfulness of earlier processing. You may also complain to a competent supervisory authority. Other applicable laws may provide additional rights.

Contact the Provider about processing for which the Provider is responsible. The reviewed implementation has no Provider-operated mechanism for remotely retrieving or deleting information in your environment or another service. For information held by your organization, a registry, repository host, IDE service or another provider, contact the relevant controller under its privacy terms. Nothing in this notice limits mandatory data-protection rights.

## 9. Changes and contact

This notice may be updated to reflect changes in the Plugin's data handling. Updates do not change the license terms governing an acquired release or retroactively authorize new processing. The notice version and update date identify the description you are reading.

For questions about the Plugin's data handling or to exercise applicable rights concerning the Provider's processing, use the contact in section 1. Earlier notice versions are preserved in the [notice archive](https://if-else.dev/licenses/dependency-radar/privacy/1.0/PRIVACY.md).