Privacy Policy
Who we are
Klikspaan is made by Jarmo Roos. Send questions about privacy to info@lemonscript.nl.
What data Klikspaan uses
- Your websites: the addresses you add. Klikspaan requests one page per site, just like a regular visitor, and looks at which software and versions are visible.
- Your GitHub repos: if you sign in with GitHub, Klikspaan reads the security alerts (Dependabot) of the repos you choose, plus a few files to determine the languages and versions used. Klikspaan cannot change anything.
- Your GitLab projects: if you connect GitLab (gitlab.com or your own server), Klikspaan reads your projects and a few files in the root folder to determine languages, versions and the packages used. Klikspaan cannot change anything.
- Settings and alerts: your settings, resolved and ignored alerts, advice and chat conversations.
All of this data is stored only on your own Mac. Your connections to GitHub, GitLab, Claude and ChatGPT are stored in your Mac's Keychain.
Who Klikspaan connects to
Directly from your Mac, without going through the maker of Klikspaan:
- GitHub (if you sign in): to fetch your repos and security alerts.
- GitLab (if you connect it): to fetch your projects and package files.
- OSV.dev (by Google, open source): Klikspaan sends the names and versions of the packages you use (for example "lodash 4.17.20") to look up known vulnerabilities. This happens for GitLab projects and for GitHub repos where Dependabot is turned off. Repo names, code and files are not included. See Google's privacy policy.
- Your own websites: to see which software is running.
- NCSC (advisories.ncsc.nl), endoflife.date and nodejs.org: public information about vulnerabilities and versions. No data about you is sent.
- Anthropic (Claude) or OpenAI (ChatGPT), only if you connect them yourself and give permission. When you click "What should I do?", the name and address of the site or repo, the software and versions found, the alert with its NCSC advisory, and your own follow-up questions are sent to that service. Your code, passwords and keys are never included. The service processes this under its own privacy policy: Anthropic, OpenAI. You can withdraw your permission at any time in Settings.
- Apple: for the subscription through the App Store. The maker of Klikspaan does not receive your name, email address or payment details from Apple.
What Klikspaan does not do
- No Klikspaan account, no server of its own.
- No analytics, tracking or advertising.
- No selling or sharing of data with anyone other than those listed above.
Retention and deletion
Data stays on your Mac for as long as you use Klikspaan. If you remove a site, sign out of GitHub or GitLab, or delete a key, it is removed from your Mac immediately. If you delete the app, you can remove the remaining files from Klikspaan's folder in Containers in your Library.
Your rights
Because the maker of Klikspaan does not receive any of your personal data, we cannot view, change or delete it either; you do that yourself in the app. If you have questions or a complaint, email info@lemonscript.nl. You can also file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
Changes
If this privacy policy changes, we update the date at the top. For major changes, we let you know in the app.