Togoder security
New scan

Legal

Privacy policy

What data the scanner handles, why, who else sees it and how long it is kept.

Last updated November 10, 2026

Who is responsible

ToGODer is responsible for the personal data processed by Togoder Security. For privacy questions or requests, email tanevanwifferen@gmail.com.

What we collect and why

  • Files you upload. A lockfile, manifest or package name is read to get the names and versions of your dependencies. The file is processed in memory and not stored; the parsed list and scan results are kept in memory for up to an hour so you can fetch them. For scans paid from a balance or run under a plan we keep only the file's name and a SHA-256 fingerprint of it, which can't be turned back into the file.
  • Package code and scan results. We download the public packages from their official registries, store file hashes and verdicts, and publish the results as public package reports. Reports do not show who requested a scan.
  • Account data. When you sign in with GitHub or Google we receive your account id at that provider, email address, display name and avatar. We use them to identify your account and show who is signed in.
  • Billing data. For subscriptions we store the Polar customer and subscription ids, plan, status and the date access runs until. Card and other payment details are handled by Polar and its payment processor and never reach our servers.
  • Prepaid balance. We store your balance and a ledger of its changes: amounts, the scan and order references they belong to, and each scan's package and token counts.
  • Automatic top-ups. We store your threshold, amount and 30-day limit, and each charge we start. To show which card will be charged, we ask Polar for its brand, last four digits and expiry date; we don't store them, and the full card number never reaches us.
  • API keys. We store a SHA-256 hash of each key, its name, a short prefix and when it was created and last used. The full key is shown to you once and not kept.
  • Usage. For scans under a plan we record the time, number of packages, tokens used and cost, the file fingerprint, and scans refused over the limit or that failed, to enforce the plan's limit, show your usage and handle refunds.
  • Account history. We log what happens on your account: sign-ins and sign-outs (which provider and when), linking or unlinking a sign-in, API keys created or revoked (by prefix, never the key), plan changes, cancellations, payments and refunds. We use it for support, refunds and security, and you can read it through the API. It does not contain IP addresses, keys or session tokens.
  • Server logs. Our servers log requests (IP address, time, path, status and user agent) to keep the service secure and to fix problems.

We process this data to provide the service you asked for (contract), to keep records we are legally required to keep, and for our legitimate interest in running a secure, reliable service. We do not sell personal data, do not show ads and do not use advertising or cross-site tracking cookies.

Cookies and browser storage

We only use cookies and browser storage needed for the site to work, such as keeping you signed in. Polar's checkout page, on its own website, may set its own cookies to process the payment; see Polar's privacy policy.

Who we share it with

  • Polar Software, Inc. sells and bills subscriptions and top-ups as merchant of record. When you start a checkout we send it your account's reference, your email address and your IP address (for the right currency and tax); it also receives the payment and tax details you enter at checkout, and processes them under its own privacy policy.
  • AI model providers. The source code of the public packages being scanned is sent to the third-party AI model providers that review it. Your uploaded file, account data and identity are not sent; the models only see public package code.
  • GitHub and Google handle sign-in when you choose them; they tell us who you are, and know that you signed in to Togoder Security.
  • Hosting. The servers that run the service store the data above.

We may also disclose data when the law requires it. Some of these providers are in the United States or other countries outside your own; where the law requires it, transfers are covered by appropriate safeguards such as standard contractual clauses.

How long we keep it

  • Uploaded files: not stored. Scan jobs: in memory for up to an hour.
  • Account, API key, usage and account history: while your account exists. When you ask us to delete your account we delete it, except billing records we must keep by law.
  • Server logs: only as long as needed for security and troubleshooting.
  • Public package reports contain no personal data about you and are kept indefinitely.
  • Polar keeps its own transaction records under its own privacy policy.

Your rights

Depending on where you live, you can ask to access, correct, delete or export your personal data, and object to or restrict how we use it. Send requests to tanevanwifferen@gmail.com. You can also complain to your data protection authority. Revoking an API key or cancelling a subscription can be done yourself from the account page.

Security

Traffic is encrypted with HTTPS, API keys are stored only as hashes, and packages are analyzed without being executed. No system is perfectly secure; if a breach affects your data we will tell you as the law requires.

Children

The service is meant for developers and is not directed at children under 16.

Changes

We will update this policy when what we do with data changes, and change the date at the top. Significant changes are announced on the site or by email to account holders.