Legal
Privacy policy
Short version: we keep what we need to run detonations and publish public reports, nothing more. No ads, no tracking cookies, no selling data. Last updated 25 October 2026.
What we collect
- What you submit: package names, repository links, or the zip files you upload.
- Detonation results: the report Detonator produces, including findings and evidence.
- Technical data: your IP address, stored with each submission to enforce rate limits, and standard server logs.
- API keys: if you have one, its name and usage counts. We store only a hash of the key itself.
We don't use analytics trackers, advertising, or cookies.
How we use it
To detonate what you submit, show you the result, publish public reports, prevent abuse, and improve Detonator's detection.
Public and private reports
Submissions are public by default: the report, the package name and its source appear in the public database. Untick "publish" (or send "public": false through the API) to keep a report private. Private reports have an unguessable link, are left out of search, and, when submitted with an API key, can only be read through that key.
How long we keep it
Uploaded files are deleted as soon as their detonation finishes, or fails. Reports are kept so the database stays useful; ask us to remove a private report at any time. Server logs and IP addresses are kept only as long as needed for security and abuse prevention.
Your choices
You can ask what we hold about you, ask us to correct or delete it, or ask us to remove a report you submitted. Email us and we'll respond within 30 days.