@cryptotaxi247 / documentation-1
Code Commits Issues Pulls Sessions CI/CD
dependabot/npm_and_yarn/npm_and_yarn-ab9a7f4bc2
@reggi/path-to-regexp dependabot/npm_and_yarn/main/copy-to-clipboard-4.0.2 dependabot/npm_and_yarn/main/eslint-10.4.0 dependabot/npm_and_yarn/main/npmcli/eslint-config-7.0.0 dependabot/npm_and_yarn/main/proc-log-7.0.0 dependabot/npm_and_yarn/npm_and_yarn-826852524d dependabot/npm_and_yarn/npm_and_yarn-ab9a7f4bc2 deprecate-totp-2fa dhei/classic-tokens gat-bypass-2fa-docs jpg619/fix-accessibility-content-flow jpg619/version-bump-tar-2 kartykp/gat-bypass-2fa-docs kartykp/upgrade-path-to-regex main maitxn/version-bump-tar patch-1 reggi/cache-based-on-version reggi/dev-engines reggi/fix-transform-prettier reggi/overrides update-search-sensitivity
mdx 364 lines 25 KB
Raw
1 ---
2 title: Privacy Questions and Answers
3 edit_on_github: false
4 ---
5
6 This notice describes how [npm, Inc.](https://www.npmjs.com/about), or _npm_ for short, collects and uses data about you.
7
8 ## What's most important?
9
10 That depends on your personal situation, which is why you should read on and decide for yourself. But at a minimum, absolutely every npm user should understand:
11
12 _The npm public registry is for making software available to everyone online._
13
14 But: _Software comes from people, and says something about us._
15
16 So: _Think carefully about what packages to publish, what data you put in those packages, and what others might do with that data._
17
18 When you create an account, certain contact information is displayed publicly in the npm platform. And when you upload a package, your name and contact information may become associated with that package.
19
20 If you find yourself in a jam, [open a support ticket](https://npmjs.com/support).
21
22 ## How does npm collect data about me?
23
24 npm collects data about you:
25
26 - when you use the [npm command](https://www.npmjs.com/package/npm), the [npx command](https://docs.npmjs.com/cli/commands/npx) or another program to access the [npm public registry](https://registry.npmjs.org/), [Enterprise registries that npm hosts](https://www.npmjs.com/enterprise), [private packages](https://www.npmjs.com/features), such as when you're publishing a software package, and APIs for functionality like account and permissions management
27
28 - when you browse the npm website, [npmjs.com](https://www.npmjs.com/)
29
30 - when you use either the npm command or the website to create an npm account, update your account, and sign up for npm services
31
32 - when you send support, privacy, legal, and other requests to npm
33
34 - when working with and researching current and potential customers
35
36 When researching potential customers, npm staff sometimes search the public World Wide Web or paid business databases. Otherwise, npm doesn't buy or receive data about you from data brokers or other private services.
37
38 npm may inadvertently collect data about you if it is included in software packages that you or others upload.
39
40 ## What data does npm collect about me, and why?
41
42 ### npm collects data about how you use npm software and registries
43
44 When you use the `npm` command, the `npx` command, or other software to work with the npm public registry, an Enterprise registry that npm hosts, or private packages, npm logs data that might be identified to you:
45
46 - a random, unique identifier, called `npm-session`, for each time you run commands like `npm install`
47
48 - the names and versions of your project's dependencies, their dependencies, and so on, that come from the npm public registry, [but not of other dependencies, like Git dependencies](https://docs.npmjs.com/cli/audit)
49
50 - the versions of Node.js, the npm command, and the operating system you are using
51
52 - an `npm-in-ci` header, showing whether the command was run on a continuous integration server
53
54 - the scope of the package for which you ran `npm install`, as an `npm-scope` header
55
56 - a `referrer` header that shows the command you ran, with any file or directory paths redacted
57
58 - data about the software you're using to access the registry, such as the `User-Agent` string
59
60 - network request data, such as the date and time, your IP address, and the URL
61
62 npm uses this data to:
63
64 - fulfill your requests, such as by sending the packages you ask for
65
66 - send you alerts about security vulnerabilities that may affect the software you're building, when you run `npm install` or `npm audit`
67
68 - keep registries working quickly and reliably
69
70 - debug and develop the `npm` command and other software
71
72 - defend registries from abuse and technical attacks
73
74 - compile statistics on package usage and popularity
75
76 - prepare reports on trends in the developer community
77
78 - improve search results on the website
79
80 - recommend packages that may be relevant to your work
81
82 ### npm collects data about how you use the website
83
84 When you visit [www.npmjs.com](https://www.npmjs.com/), [docs.npmjs.com](https://docs.npmjs.com/), and other npm websites, npm uses cookies, server logs, and other methods to collect data about what pages you visit, and when. npm also collects technical information about the software and computer you use, such as:
85
86 - your IP address
87
88 - your preferred language
89
90 - the web browser software you use
91
92 - the kind of computer you use
93
94 - the website that referred you
95
96 npm uses data about how you use the website to:
97
98 - optimize the website, so that it's quick and easy to use
99
100 - diagnose and debug technical errors
101
102 - defend the website from abuse and technical attacks
103
104 - compile statistics on package popularity
105
106 - compile statistics on the kinds of software and computers visitors use
107
108 - compile statistics on visitor searches and needs, to guide development of new website pages and functionality
109
110 - decide who to contact about about product announcements, service changes, and new features
111
112 ### npm collects account data
113
114 Many features of npm services require an npm account. For example, you must have an npm account to publish packages to the npm public registry.
115
116 To create an npm account, npm requires a working email address and an available user name. npm uses this data to provide you access to features and identify you across npm services, publicly and within npm.
117
118 You do not have to give your personal or legal name to create an npm account. You can use a pseudonym instead. You can also open more than one account.
119
120 If you sign up for an account, then npm will publish account data for the whole world to see on user pages [like this one](https://www.npmjs.com/~kemitchell). npm also publishes account data through the npm public registry, which is available for everyone to see, and Enterprise registries that npm hosts for others to find with commands like npm owner ls tap.
121
122 If you give npm a personal name or names on social media like [GitHub](https://github.com/) through the website, like when you include this on your profile or user page, npm publishes that data along with the email address and user name for the account. You don't have to give npm a personal name or any social media names, and you can remove this data at any time by updating your user page.
123
124 npm uses your email to:
125
126 - notify you about packages published using your account
127
128 - reset your password and help keep your account secure
129
130 - add metadata to packages that you publish
131
132 - contact you in special circumstances related to your account or packages
133
134 - contact you about support requests
135
136 - contact you about legal requests, like DMCA takedown requests and privacy complaints
137
138 - announce new npm product offerings, service changes, and features
139
140 - send you tips about how to better use free and paid services
141
142 - send you messages about paid services you might want
143
144 ### npm collects package data
145
146 When you use npm publish or other software to publish packages to the npm public registry, an Enterprise registry that npm hosts, or as a private package, npm collects the contents of the package, plus [metadata](https://en.wikipedia.org/wiki/Metadata), including your account data. Other npm users may also publish packages that include data about you, such as the fact that you contributed code to a package.
147
148 npm uses data in packages to provide those packages to you and others who request them:
149
150 - When you publish a package to the npm public registry, or change a package from private to public, npm makes the package and metadata available to everyone, online.
151
152 - When you publish a package to an Enterprise registry that npm hosts, or as a private package, npm makes all of that data available to other users according to how the registry or the private packages account is configured. You may be able to configure who can access the package, or that may be up to others, such as the administrator of your company's Enterprise registry.
153
154 Making package data available to others allows them to download, build on, and depend on your work.
155
156 ### npm collects payment card data
157
158 To sign up for paid services, npm requires your payment card data. npm itself does not collect or store enough information to charge your card itself. Rather, [Stripe](https://stripe.com/) collects that data on npm's behalf, and gives npm security tokens that allow npm to create charges and subscriptions.
159
160 npm uses your payment card data only to charge for npm services.
161
162 npm instructs [Stripe](https://stripe.com/) to store your payment card data only as long as you use paid npm services.
163
164 ### npm collects data about correspondence
165
166 npm collects data about you when you send npm support requests, legal complaints, privacy inquiries, and business inquiries. Those data usually include your name and email address, and may include your company or other affiliation.
167
168 npm uses contact data to:
169
170 - respond to you
171
172 - compile aggregate statistics about correspondence
173
174 - train support staff and other npm personnel
175
176 - review the performance of npm personnel who respond
177
178 - defend npm from legal claims
179
180 ### npm collects data about use of npm.community
181
182 npm collects data about visits, user accounts, and forum data on [npm.community](https://npm.community/), the discussion forum for users of npm products and services. npm uses data from npm.community to collaborate with the development community, and to inform development decisions about the command-line interface and other software.
183
184 ## Does npm share data about me with others?
185
186 npm shares account data with others as [mentioned in the section about account data](#npm-collects-account-data).
187
188 npm shares package data with others as [mentioned in the section about package data](#npm-collects-package-data).
189
190 npm publishes posts and other content you submit to [npm.community](https://npm.community/).
191
192 npm does not sell information about you to others. However, npm uses services provided by other companies to provide npm services. The types of service providers that npm uses include:
193
194 - Companies that enable us to offer features on our website, such as to display your avatar
195
196 - Companies that facilitate the efficient distribution of content
197
198 - Cloud computing platforms and services that host our discussion forums
199
200 - Services that assist with the detection of spam, scams, abuse others, or other violations of our [terms of service][open-source-terms]
201
202 - Payment processors
203
204 - Platforms to help us receive, manage, and respond to support requests
205
206 - Platforms for internal communication
207
208 ### npm uses cookies
209
210 npm's website only uses cookies strictly necessary to provide, optimize and secure the website. For example, we use them to keep you logged in, remember your preferences, authenticate your device for security purposes, analyze your use of the service, compile statistical reports, and provide information for future development of npm. The website uses internal cookies for analytics purposes, not any third-party analytics or service providers.
211
212 By using the website, you agree that we can place these types of cookies on your computer or device. If you disable your browser or device’s ability to accept these cookies, you will not be able to log in or use the website.
213
214 ## How can I make choices about data collection?
215
216 You choose what data the npm publish command includes in package data. You can use an [.npmignore](https://docs.npmjs.com/files/package.json#files) file in your package to keep specific files out of the package. You can also use a [files list in package.json files](https://docs.npmjs.com/files/package.json#files) to instruct npm to include only specific files that you name, in addition to standard files like `README` files, `LICENSE` files, and package.json.
217
218 To double check the data that you will share in a package that you plan to publish, run the `npm publish --dry-run` command. If you are running an older version of the npm command, run the npm pack command to create a [tarball](<https://en.wikipedia.org/wiki/Tar_(computing)>), then check its contents, such as with `tar tvzf $tarball`.
219
220 To publish a package to the npm public registry, npm's terms of service require you to [license npm to share it][your-content]. If a package is made public, it is available for everyone online to see. However, your [choice of public license for your package](https://docs.npmjs.com/files/package.json#license) may affect what others can do with data about you in your package.
221
222 npm does not respond to the [Do Not Track HTTP header](https://en.wikipedia.org/wiki/Do_Not_Track).
223
224 ## Where does npm keep data about me?
225
226 npm stores account data, data about website use, data about registry use, and private packages on servers in the United States of America. metadata about those packages worldwide, via content delivery networks.
227
228 npm stores package data published to Enterprise registries that npm hosts, plus metadata about them, in cloud computing zones of customers' choosing.
229
230 By using the npm platform, you consent to the collection and storage of your data as outlined in this section.
231
232 ## How does npm handle data under the EU General Data Protection Regulation?
233
234 npm respects privacy rights under [Regulation (EU) 2016/679](http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv:OJ.L_.2016.119.01.0001.01.ENG), the European Union's General Data Protection Regulation (GDPR). npm processes "Personal Data" on the following legal bases: (1) with your consent; (2) as necessary to perform our agreement to provide our services; and (3) as necessary for our legitimate interests in providing our services where those interests do not override your fundamental rights and freedom related to data privacy. Information we collect may be transferred to, and stored and processed in, the United States or any other country in which we or our affiliates or subcontractors maintain facilities, as described above.
235
236 If you reside in the EEA, Switzerland, or United Kingdom, you are entitled to certain rights, like the right to:
237
238 - complain about our data collection or processing actions with the supervisor authority concerned. You can find a list of data protection authorities [here](http://ec.europa.eu/justice/data-protection/bodies/authorities/index_en.htm).
239
240 - access to information held about you.
241
242 - ask us to correct or amend inaccurate or incomplete information we have about you.
243
244 - ask us to erase data that under certain circumstances, like (1) when it is no longer necessary for the purpose for which it was collected, (2) you withdraw consent and no other legal basis for processing exists, or (3) you believe your fundamental rights to data privacy and protection outweigh our legitimate interest in continuing the processing.
245
246 - request that we restrict our processing if we are processing your data based on legitimate interests or the performance of a task in the public interest as an exercise of official authority (including profiling); using your data for direct marketing (including profiling); or processing your data for purposes of scientific or historical research and statistics.
247
248 When you exercise your rights, npm may need to verify your identity and provide us with information before we access records containing your information. If you want to exercise your rights, please contact npm by [opening a support ticket](https://npmjs.com/support). We may have a reason under the law why we do not have to comply with your request or may comply with it in a more limited way than you anticipated. If we do, we will explain that to you in our response.
249
250 ## How does npm handle data under the California Consumer Privacy Act?
251
252 npm respects the rights of California residents under the [California Consumer Privacy Act](https://www.oag.ca.gov/privacy/ccpa) (CCPA). Where we collect information that is subject to the CCPA, that information we collect and your rights are described below.
253
254 Categories of personal information we collect:
255
256 - _Personal Identifiers_:
257 - Name and email address when you create an account. You will also be asked to create a username and we will assign one or more unique identifiers to your profile. We use this information to provide our services, respond to your requests, and send information to you.
258
259 - We also collect your social media handle and basic account information if you provide it to us or interact with our services, such as our help desk, through social media.
260
261 - We collect your payment information through our service provider, Stripe, as described above.
262
263 - _Internet or Other Electronic Network Activity Information_: device identifiers such as IP address and user agent; the assigned unique IDs in cookies (as described below); information about how you arrived at and navigated through our Services.
264
265 - _Geolocation Data:_ We do not collect your specific longitude and latitude. However, we do collect imprecise location (e.g., your IP address).
266
267 - _Professional or employment-related information:_ If you apply for employment with us, information about your employment history.
268
269 - _Education information:_ If you apply for employment with us, information about your educational history.
270
271 We may collect any other information about you contained in software packages uploaded to our site, as described above under the "npm collects package data" section. We also collect the contents of your communications with us, e.g., when you submit a question to us through a web form or comments to us on social media.
272
273 We may disclose any of the categories of personal information listed above and use them for the above-listed purposes or for other business or operational purposes compatible with the context in which the personal information was collected. Our disclosures of personal information include disclosures to our "service providers," which are companies that we engage for business purposes to conduct activities on our behalf. The categories of service providers with whom we share information and the services they provide are described below.
274
275 Rights under CCPA:
276
277 - _Access/Right to Know_: You have the right to request access to personal information we collected about you and information regarding the source of that personal information, the purposes for which we collect it, and the third parties and service providers with whom we share it.
278
279 - _Deletion_: You have the right to request that we erase data we have collected from you. Please note that we may have a reason to deny your deletion request or delete data in a more limited way than you anticipated, e.g., because of a legal obligation to retain it.
280
281 To exercise your rights above, you can [open a support ticket](https://npmjs.com/support). When we process your request, we must verify your identity by asking you to (1) provide personal identifiers that we can match against information we may have collected from you previously; and (2) confirm your request using the email stated in the request.
282
283 Opt-out of sale:
284
285 California residents have the right to request that we stop "selling" their personal information. A "sale" of personal information is defined broadly: "selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer's personal information by the business to another business or a third party for monetary or other valuable consideration." We do not sell your information as defined by the CCPA.
286
287 Please note that your right to opt out does not apply to our sharing of personal information with service providers, who are parties we engage to perform a function on our behalf and are contractually obligated to use the Personal Information only for that function.
288
289 We may also disclose information to other entities who are not listed here when required by law or to protect our Company or other persons, as described in our Privacy Policy.
290
291 ## How can I see what data is publicly available about me?
292
293 You can access your account data at any time by visiting your account page on [www.npmjs.com](https://www.npmjs.com/). Your account page also lists all the packages published under your account or other accounts.
294
295 You can access package data by downloading the packages, as long as they're public or you have permission to access them.
296
297 You can see metadata about packages by running npm info $package, or by accessing the appropriate [registry's API](https://github.com/npm/registry/tree/master/docs). Registry APIs provide metadata in standard [JSON](https://www.json.org/) format, and packages as [tarballs](<https://en.wikipedia.org/wiki/Tar_(computing)>).
298
299 ## How can I change data about me?
300
301 You can change your personal account data and payment card data at any time by visiting your account settings page on [www.npmjs.com](https://www.npmjs.com/). You can change account and payment data for Enterprise by [contacting support](https://npmjs.com/support).
302
303 You can close your npm account at any time by e-mailing [contacting support](https://npmjs.com/support). Closing your account removes the profile from the public registry but does not automatically erase packages published under your account. We may retain some data about you internally even where you close your account.
304
305 npm's [unpublish policy][unpublish] determines when you can erase packages from the npm public registry. The unpublish policy strikes a difficult balance between the purpose of publishing and hosting packages, others' reliance on what has been made public, and individual rights and freedoms.
306
307 If another user improperly publishes personal data about you, in a package or otherwise, [open a support ticket](https://npmjs.com/support).
308
309 Please note that while [npm publishes notices about published data that's been erased](#how-does-npm-notify-others-about-published-data-thats-erased), npm can't make everyone who has downloaded published package data or account data erase that data on your behalf. Choosing a public license, such as an open source software license, may encourage and allow storage, distribution, and use of package data indefinitely. Nearly all popular open source software licenses actually require preserving personal data that attributes the software to you, such as copyright notices, as a condition of permission for the software.
310
311 ## What is npm's policy on unpublishing packages?
312
313 Please see [our policy on "unpublishing" packages][unpublish] or [our terms of service][open-source-terms] for more information on erasing packages.
314
315 If you accidentally publish a package that threatens your privacy, or discover someone else has published a package that does, [open a support ticket](https://npmjs.com/support). npm can and will take down packages in specific, exceptional situations to protect you, especially if others violate your privacy. Using npm to violate others' privacy is against our [terms of service][open-source-terms].
316
317 ## How does npm notify others about published data that's erased?
318
319 npm takes a few steps to notify others who may be copying data from the npm public registry that published data has been erased:
320
321 - npm publishes new placeholder versions of some erased packages, with `README` files that mention the package has been erased, and why.
322
323 - npm's [registry APIs](https://github.com/npm/registry/tree/master/docs), special software services that others use to copy data from the npm public registry, send update messages about packages that have been erased.
324
325 ## What happens if npm merges with or is bought by another company?
326
327 We may transfer to another entity or its affiliates or service providers some or all information about you in connection with, or during negotiations of, any merger, acquisition, sale of assets or any line of business, change in ownership control, or financing transaction. We cannot promise that an acquiring party or the merged entity will have the same privacy practices or treat your information the same as described in this Policy.
328
329 ## What are npm's information practices regarding information belonging to children?
330
331 npm's site and services are intended for users age sixteen and older. npm does not knowingly collect information from children. If we discover that we have inadvertently collected information from anyone younger than the age of 16, we will delete that information.
332
333 ## Who can I contact about npm and my privacy?
334
335 Please [open a support ticket](https://npmjs.com/support). You may also contact our Data Protection Officer directly.
336
337 Our United States HQ:
338
339 GitHub Data Protection Officer
340 Attention: npm Data Protection
341 88 Colin P. Kelly Jr. St.
342 San Francisco, CA 94107
343 United States
344
345 or our EU Office:
346
347 GitHub BV
348 Vijzelstraat 68-72
349 1017 HL Amsterdam
350 The Netherlands
351
352 ## How can I find out about changes?
353
354 This version of npm's privacy questions and answers took effect June 3, 2020.
355
356 npm will announce the next version on the [npm blog](https://blog.npmjs.org/). In the meantime, npm may update [its contact information](#who-can-i-contact-about-npm-and-my-privacy) by updating the page at [https://docs.npmjs.com/privacy][privacy], without an announcement. npm may change how it announces changes in future privacy versions.
357
358 You can review the history of changes in [the Git repository for npm's public policies](https://github.com/npm/documentation/blob/main/content/policies/privacy.mdx).
359
360 [terms]: /policies/terms
361 [privacy]: /policies/privacy
362 [open-source-terms]: /policies/open-source-terms
363 [unpublish]: /policies/unpublish
364 [your-content]: /policies/open-source-terms#your-content