Ripedeps
Menu
ToolHow it worksAPIMCPCLIPrivacy
Privacy

What happens to your package.json

Short version: Ripedeps plans and never writes to your machine. The files you send and our answers are stored for analysis. No accounts, no cookies, no tracking, and no IP addresses stored with your files.

Uploaded package.json files and the resulting recommendations are stored for analysis and for improving the algorithm. Do not send files that contain secrets.

What happens to your package.jsonYou send the file to the Ripedeps service. It asks the public npm registry for the packages it lists and returns a diff, the new file and explanations. Nothing is written to your machine and nothing is committed.You or your agentapplies the changeRipedepsplans, never writesnpm registrypublic package datapackage.jsondiff + whynamesstored for analysisfile, result, settingsnot stored: IP, headers,user agent, identity
The service plans; it never touches your repository. See the privacy page for the exact list.

Who is responsible

The controller of the data described here is Balázs Csaba EV (sole proprietor, Hungary). Contact: privacy@ripedeps.com, or through deployment.hu.

What is stored

When a plan completes successfully, through the web tool, the REST API, the MCP server or the script, one record is kept:

  • the package.json text you sent, or the file the service downloaded from the URL you gave,
  • the recommendation returned (the new file, the diff and the per-package details),
  • the request parameters as sent (a URL is stored without its query string and fragment) and the settings that were used,
  • the time, which interface was used (API or MCP), the version of the service, and a SHA-256 hash of the file,
  • whether the plan was solved exactly and whether it contained at least one upgrade.

Credentials that appear in URLs inside the stored texts (scheme://user:password@host) are replaced with *** before they are stored. Do not send files that contain secrets anyway: redaction is a safety net, not a promise to find every secret.

Requests that fail validation or planning are not stored.

What is not stored

  • IP addresses, request headers (including the user agent) and any user identifier.
  • Anything about you: there are no accounts or logins.

This website sets no cookies and runs no analytics or advertising scripts. Fonts and images are served from the site itself. The application logs contain no package.json content and no URL query strings.

Why it is stored

The records are used to analyse how the planner behaves on real files and to improve the algorithm, for example to replay a plan after a change. The legal basis is the controller's legitimate interest in developing and improving the service (GDPR Article 6(1)(f)). The records are not sold, shared or published.

No page, endpoint or MCP resource of the service shows stored records, and they are never copied into the source repository, the container images or the logs. They can only be read with direct access to the database, which only the operator has.

Other parties involved

  • The npm registry. To plan upgrades the service asks the public registry (registry.npmjs.org) about the packages listed in your file. The package names are public information; the rest of your file is not sent there.
  • GitHub, for the examples. The example buttons on the home page make your browser download a public package.json from raw.githubusercontent.com. Nothing you typed is sent there; GitHub sees the request as it would any visit to that file.
  • Your URL. If you give a packageJsonUrl, the service downloads that one file. It sends no cookies and no credentials.

Deletion and your rights

Because no IP address or identifier is stored, a record cannot be found by who sent it. It can be found by the SHA-256 hash of the file. To ask for deletion of a record, or for access to it, write to the controller at privacy@ripedeps.com with the hash, for example from:

terminal
shasum -a 256 package.json

If you sent a secret by mistake, tell us right away so the record can be removed, and rotate the secret. You also have the rights the GDPR gives you (access, rectification, erasure, restriction, objection), and you can complain to the Hungarian data protection authority (NAIH, naih.hu).

Changes

This page describes the service as it works today. If that changes, this page changes first. Last updated: 24 October 2026.