This policy explains what personal data privatenpm-com (the "Service") collects, why, and what you can do about it. It applies to everyone who visits the public pages or uses the Service with an account.
What we collect
- Account data: your email address, name, time zone and presentation preferences, and the credentials you sign in with (a password hash, passkeys, or the link to your identity provider). Passwords are stored only as Argon2id hashes.
- Organization data: the organizations you belong to, your role in them, invitations, and the content your organization stores in the Service (for example projects and files).
- Usage and security data: sign-ins and sessions (browser, approximate address), audit log entries describing changes to your organization, and technical logs needed to run the Service safely.
- Communication data: the emails we send you (sign-in links, security notices, notifications) and whether they were delivered.
We do not use third-party analytics or advertising trackers on the Service.
Why we use it
- To provide the Service: sign you in, show your organizations, deliver notifications and support you.
- To keep the Service secure: detect abuse, throttle sign-in attempts, and keep an audit trail for organization admins.
- To meet legal obligations, such as accounting and responding to lawful requests.
We rely on the performance of our agreement with you and, for security and abuse prevention, on our legitimate interest in running the Service safely.
We send account email (verification, password reset, security notices) because the Service cannot work without it. Notification email is optional: every message carries an unsubscribe link and you can choose channels per notification type under your account's notification settings.
Who sees your data
- Admins of an organization you belong to see your name, email, role and the audit trail of that organization.
- Our infrastructure providers (hosting, email delivery, object storage) process data on our behalf under contracts that bind them to this policy.
- We do not sell personal data.
How long we keep it
- Account data stays while your account exists. You can delete your account from your profile; organizations where you are the only member are deleted with it.
- Organization data stays while the organization exists, within the retention periods its admins configure for audit logs, notifications and the trash.
- Sessions expire and are removed automatically; the email delivery log and exhausted background jobs are kept for a limited time and then removed.
Your rights
Depending on where you live you may have the right to access, correct, export, restrict or delete your personal data, and to object to some uses of it. You can export your account data and delete your account from your profile at any time. For anything else, contact the operator of this installation.
Cookies
The Service uses one strictly necessary cookie to keep you signed in. It is not used for tracking.
Changes to this policy
We may update this policy. Each version carries an effective date, and material changes are announced in the Service.
Contact
Questions about privacy go to the operator of this installation.