Privacy Policy

Last updated: August 24, 2026

This Privacy Policy describes how Spryly™ ("Spryly™," "we," "us," or "our"), a product of LateralTranslucence, collects, uses, and protects information when you use spryly.io (the "Service").

1. Information We Collect

Account Information

When you create a Spryly™ account, we collect your email address and a password (which is securely hashed and never stored in plain text). We use Supabase as our authentication and database provider to store this information.

Package and Project Data

Spryly™ stores the information you provide to use the Service, including:

• Names of packages/libraries you choose to track
• The registry each package belongs to (e.g. npm, PyPI, Packagist, Go, RubyGems, Cargo, NuGet, WordPress)
• Installed and latest version numbers
• Project names you associate with tracked packages
• Display order and other preferences for organizing your dashboard

Service Status Data

If you use the Services tab to track the status of platforms you depend on (such as Cloudflare, AWS, GitHub, Slack, or Stripe), we store:

• The platforms you choose to track
• Project names you associate with tracked platforms
• Whether we've already sent you an alert for a platform's current incident, so we don't email you repeatedly about the same issue

We do not store the historical status data itself — current status is fetched from each platform's public status page each time it's checked.

GitHub Account Connection (Optional)

If you choose to connect GitHub to use the repository scanning feature, we collect:

• The name of the GitHub account or organization Spryly™ is installed on
• The installation identifier GitHub issues for it

Spryly™ connects as a GitHub App holding Contents: read-only and Metadata: read-only permissions, on the repositories you select when installing it. We store no GitHub access token. Access is issued for one hour at a time using our own signing key and is never written to our database. You can remove an installation at any time from GitHub or from your profile settings.

What We Read From Your Repositories

When you run a scan, we read dependency manifests and lockfiles — files such as package.json, package-lock.json, requirements.txt, composer.json, or go.mod — to identify dependency names and versions.

When you request an upgrade briefing on a Pro account for a project backed by a GitHub repository, we additionally read source files from that repository in order to locate where the identifiers named in a release's notes appear in your code. This happens only at the moment you request a briefing, and only for that repository.

Those repository contents are searched in memory and discarded when the request finishes. We do not store your source code, and we never send it to an AI model or any other third party — only publicly published release notes are sent for summarization. See our AI Policy for exactly what is and is not sent.

GitLab Account Connection (Optional)

If you choose to connect a GitLab account, we collect:

• Your GitLab username
• An access token and refresh token issued by GitLab, used to read repository contents on your behalf

We request read-only scopes only (read_api and read_user). GitLab tokens are stored server-side, are never sent to your browser, and are removed when you disconnect the account from your profile settings. The reading described above applies equally, except that per-codebase impact matching is currently available for GitHub repositories only.

Payment Information

If you subscribe to Spryly™ Pro, payment is processed by Stripe. We do not store your credit card number or payment details — Stripe handles all payment processing and stores your billing information on our behalf. We store only a Stripe customer ID in order to manage your subscription.

Automatically Collected Information

With your consent, we use Google Analytics 4 to understand how visitors use the Service in aggregate. Google Analytics collects information such as pages visited, time spent on the Service, browser type, device type, and approximate geographic location (derived from your IP address). This data is processed by Google and is not used to personally identify you. You can opt out of Google Analytics tracking using Google's opt-out browser add-on, or by declining analytics in our cookie banner.

We also use Fathom Analytics to measure page views and a small number of product actions, such as starting a repository scan or sending us a message. Fathom sets no cookies, stores nothing on your device, and collects no personal data — its measurements are anonymous and aggregate, and cannot be traced back to you or followed across other websites. Because there is nothing personal to collect, Fathom runs without consent and there is no profile of you to opt out of.

We also collect basic technical information as part of standard server logging (such as IP address and browser type) necessary to operate the Service.

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Service
• Authenticate your account and keep your data synced across sessions
• Check tracked packages against public package registries (npm, PyPI, etc.) for version updates
• Check the public status pages of platforms you track on the Services tab, and email you if one reports an issue
• Scan connected GitHub and GitLab repositories (only when you initiate a scan) to detect dependencies
• Read repository source files, on Pro accounts and only when you request an upgrade briefing, to locate where a release's named identifiers appear in your code
• Process payments and manage your subscription through Stripe
• Send transactional emails (account confirmation, subscription changes, account deletion confirmation, service status alerts) via SendGrid
• Monitor and improve the reliability and performance of Spryly™

3. Third-Party Services

Spryly™ relies on the following third-party services to operate:

• Supabase — database hosting, authentication, and storage of your account and package data. See Supabase's privacy policy.
• Stripe — payment processing and subscription management. Stripe stores your payment details on our behalf. See Stripe's privacy policy.
• SendGrid — transactional email delivery (account confirmation, subscription and deletion notifications, service status alerts). See SendGrid's privacy policy.
• GitHub — if you install Spryly™ on a GitHub account or organization, GitHub processes the authorization and provides repository data to Spryly™ for the repositories you selected. See GitHub's privacy statement.
• Anthropic — upgrade briefings send publicly published release notes to Claude for summarization. No source code, repository names, account details, or other identifying information is sent, and the request does not identify who asked. See Anthropic's privacy policy and our AI Policy.
• GitLab — if you connect a GitLab account, the same applies. See GitLab's privacy policy.
• Google Analytics 4 — website analytics, loaded only if you consent. Google collects aggregate usage data about visits to the Service. See Google's privacy policy.
• Fathom Analytics — cookieless, privacy-focused website analytics. Fathom collects anonymous aggregate usage data and no personal information. See Fathom's privacy policy.
• Public package registries (npm, PyPI, Packagist, Go module proxy, RubyGems, Cargo/crates.io, NuGet, WordPress.org) — Spryly™ queries these public APIs to retrieve current version information for packages you track. No personal account information is sent to these registries.
• Platform status pages (Cloudflare, AWS, Google Cloud, Slack, Heroku, Stripe, and other services you choose to track) — Spryly™ queries each platform's public status page or status API to retrieve current operational status. No personal account information is sent to these providers.

We do not sell your personal information to third parties.

4. Data Retention and Deletion

We retain your account and package data for as long as your account remains active. If you delete your account, we immediately and permanently delete your profile, tracked packages, tracked platforms, project associations, and all connected GitHub and GitLab account tokens. Any active paid subscription is cancelled at the same time.

You can delete your account at any time through your profile settings, or by contacting us at hi@spryly.io.

5. Data Security

We take reasonable measures to protect your information, including encryption in transit (HTTPS), access controls on our database via Supabase's row-level security policies (which ensure each user can only access their own data), and secure storage of authentication tokens. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

6. Your Rights

Depending on your location, you may have rights under applicable data protection laws (such as the GDPR or CCPA), including the right to:

• Access the personal information we hold about you
• Request correction or deletion of your information
• Request a copy of your data in a portable format
• Withdraw consent for optional features (such as the GitHub or GitLab connection) at any time via your profile settings

To exercise any of these rights, contact us at hi@spryly.io.

7. Children's Privacy

Spryly™ is not directed to individuals under the age of 16, and we do not knowingly collect personal information from children.

8. International Users

Spryly™'s infrastructure is hosted via Supabase, which may store data in data centers located outside your country of residence. By using the Service, you consent to the transfer of your information to these locations.

9. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify users via the Service or by email. Continued use of the Service after changes take effect constitutes acceptance of the revised policy.

10. Contact Us

If you have questions about this Privacy Policy or how your data is handled, contact us at:

hi@spryly.io LateralTranslucence