PRIVACY
What we collect, and what we do not
Cohen analyses public software packages. It is not a product that needs to know much about you, so it does not ask for much. This page describes every category of personal data the service handles, why it is handled, how long it is kept and how to have it removed.
Last updated 4 September 2026. Operated by [LEGAL ENTITY NAME], [REGISTERED ADDRESS], India.
WHAT WE HOLD
Four categories, and nothing else
| Data | Why we have it | How long we keep it |
|---|---|---|
| Your Google account identifier, email address, display name and profile picture URL | To identify your account and to contact you about your API keys. Received from Google when you sign in. | Until you delete your account |
| API key records: a cryptographic hash of each key, its display prefix, name, scopes, expiry and last-used time | To authenticate your API requests and to show you your own keys | Until you delete your account |
| Usage records: counts of lookups and analyses, the package names and versions you queried, and timestamps | To apply your plan's allowance, to prevent abuse, and to show usage in your dashboard | 13 months, then aggregated |
| Technical logs: IP address, user agent and request path | Security, rate limiting and diagnosing faults | 30 days |
What we do not do
- We do not sell personal data, and we do not share it for advertising.
- We do not run advertising, analytics or tracking scripts on this site.
- We do not read your source code. Mantis resolves your dependency tree locally and sends only package names and versions.
- We never store your API key itself, only a keyed hash of it. If you lose a key we cannot recover it, and neither can anyone who steals our database.
- We do not ask Google for access to your Gmail, Drive, contacts or calendar. The only permissions we request are your basic profile and email address.
PRIVATE PACKAGES
Names leave your machine, code does not
When you submit a dependency tree, we receive package names and version
numbers. If your project depends on private or internal packages, those
names reach us unless you set skip_private, which drops names
that do not resolve on the public registry before they leave your side of
the wire. Package names can themselves be sensitive in some organisations,
so this is worth setting deliberately rather than by default.
COOKIES
Three cookies, none of them for tracking
__Host-cohen_session
Set on the console after you sign in, so we know it is still you. Removed when you sign out or after 14 days. Strictly necessary.
cohen_oauth_tx
A ten-minute cookie that carries the security parameters of a sign-in that is in progress. Deleted the moment sign-in completes.
cohen_signed_in
Contains the single character 1 and nothing else. It lets
this site show a link to your dashboard rather than a sign-up prompt. It
identifies nobody and grants no access.
WHO ELSE TOUCHES IT
Two processors, named
Google LLC
Handles sign-in. Google tells us your identifier, email address, name and profile picture. We never see your Google password. Google's own handling of your data is governed by its privacy policy, not this one.
Cloudflare, Inc.
Carries traffic between you and our servers, and filters abuse. It processes IP addresses and request metadata in transit.
Our application servers and database are operated by us on our own hardware in India. We will name any further processor here before adding it. We may disclose data where a law that binds us requires it.
YOUR RIGHTS
Access, correction, erasure
Whichever law applies to you, the practical answer is the same: write to us and we will do it. Under India's Digital Personal Data Protection Act 2023 you may access a summary of your data, have it corrected or completed, have it erased, nominate someone to act for you, and raise a grievance. If you are in the UK or EEA, the UK GDPR and GDPR give you comparable rights including portability and objection.
We answer requests within 30 days. To verify a request we will ask you to send it from the email address on the account.
Deleting your account
Email contact@snappyfeet.org from your account address. We revoke every key immediately and erase your account, keys and personal identifiers. Usage counts survive in aggregate form with no link to you, and anything we are legally required to retain is kept only for as long as that requirement lasts.
Grievances
If you are unhappy with how we have handled your data, contact our Grievance Officer: [NAME], [EMAIL]. If we do not resolve it, you may complain to the Data Protection Board of India, or to your local supervisory authority if you are in the UK or EEA.
SECURITY
What we actually do about it
- All traffic is encrypted in transit. Requests to the API over plain HTTP are refused rather than redirected.
- API keys are stored as keyed hashes, never in a recoverable form.
- The sandbox that executes untrusted packages runs on separate infrastructure and holds no credentials for the account database.
- Keys expire on a fixed schedule and can be revoked instantly from your dashboard.
No system is perfectly secure. If you find a vulnerability, please report it to contact@snappyfeet.org before disclosing it publicly, and we will work with you. If a breach is likely to affect you, we will notify you and the relevant authority as the law requires.
CHANGES AND CHILDREN
Two short notes
Cohen is a developer tool and is not directed at children. We do not knowingly collect data from anyone under 18. If you believe a child has an account, tell us and we will remove it.
If we change this policy in a way that materially affects you, we will email the address on your account before it takes effect. The date at the top always reflects the current version.