# Dependency Radar Privacy Notice

Notice version: 1.0.
Last updated: 2026-10-09.

## 1. Provider and scope

Dependency Radar, plugin identifier `io.dependencyradar` (the "Plugin"), is provided by Nikita Kryukov, operating under the brand if-else.dev (the "Provider"). This notice describes data handling in the free beta implementation reviewed on the date above, including local analysis and operations performed through your configured tools.

This notice covers the Plugin's own processing. Your IDE, JetBrains Marketplace, package managers, registries, repository hosts and other tools or services have their own data practices. Visiting the website or contacting support is separate from running the Plugin. This notice does not change the [End User License Agreement](https://if-else.dev/projects/dependency-radar/eula/) or itself constitute consent to processing.

## 2. Local information and purposes

The Plugin reads project directories, package manifests and lockfiles to discover projects, compare dependency versions and build dependency graphs. It processes paths, file timestamps, package names and versions, dependency declarations, package-manager configuration, Git branch names and working-tree status. A configured search provider may inspect other files beneath the selected project directories; its scope depends on the provider and arguments you configure.

This information is used to display dependency relationships and publication status and to prepare project actions. Project paths, exclusions, search-provider settings, action definitions and other preferences are saved through the IDE in `dependency-radar.xml`. Scan caches, view state and operation journals are held in memory; the Plugin does not implement a persistent journal database. Project operations can write project files; those changes have a different lifetime from the Plugin's temporary state.

Paths, branch names, package metadata, command text and output can contain personal or confidential information, depending on your projects and configuration.

## 3. Network communications and background checks

The Plugin invokes your configured package manager to query whether a package name and version have been published. For projects identified as publishable, this check may run automatically when the project view is initialized or refreshed, including refreshes following relevant file changes. These requests do not require you to start a publication or confirm each request.

Package-manager requests use the registry selected from project, user or environment configuration, or the tool's default registry. Public and private registries may receive package identifiers, version information, authentication information and request metadata such as a source IP address or tool identification. Installing dependencies may request additional packages. Publishing sends the package contents and metadata selected by the package manager and its configuration.

Configured commands, package-manager hooks and Git operations can also communicate with repository hosts, third-party APIs or other services and transmit data according to their behavior. The Plugin has no built-in GitHub or GitLab API client. The recipients, transmission details, server location and server-side retention depend on the tools, destinations and services involved. Consult the relevant service providers' privacy terms for their processing.

## 4. Authentication and credentials

Operations use permissions and configuration available in your local environment. External tools may use credentials from their own configuration, environment variables or credential helpers. When preparing certain Yarn registry operations, the Plugin reads matching npm authentication tokens from npm configuration and passes them to the package-manager process as `YARN_NPM_AUTH_TOKEN`. Reading registry configuration can include project or ancestor `.npmrc` files, user npm configuration and configured environment values; Yarn registry selection also considers `.yarnrc.yml`.

The Plugin does not implement a separate credential vault. Values included in saved action definitions are ordinary IDE settings, not a dedicated secret store. External commands may print credentials or sensitive data, and the Plugin does not implement general secret redaction for their output. Use appropriate tool credential configuration and review output before copying or sharing it.

## 5. Diagnostics, telemetry and Provider services

Command output, errors and operation results may appear in the local operation journal or publication-status diagnostics. Some failures are recorded through IDE logging, so IDE log files may contain paths, exception details or other diagnostic information. Journal text can be copied to the clipboard when you use the copy action.

The beta implementation described here contains no Plugin-operated analytics, telemetry uploader, automatic crash-report submission or built-in integration that sends project data or credentials to a Provider-operated backend. This describes the Plugin's implementation; it does not describe reporting, synchronization or network behavior of the IDE, external tools, configured commands or services. Diagnostics that you choose to copy or submit leave the local environment through the channel you select.

## 6. Storage and retention

In-memory state lasts while the relevant Plugin objects are active. Saved IDE settings, IDE logs, tool caches, credentials stored by external tools and project files are retained according to those systems and your actions. The Plugin sets no automatic deletion period for those persisted materials, and uninstalling it does not guarantee their removal. Copies you make or share have their own lifetime. Retention of information received by registries and other external services is determined by those services.

## 7. Your controls and rights

You can change the project root, exclusions, search provider, configured actions and tool or registry configuration. Review publication destinations and package contents, use credentials with suitable permissions, and remove sensitive values from saved commands and shared diagnostics. The publication confirmation setting concerns publication actions; it does not turn off automatic publication-status requests. The Plugin has no separate setting to disable those requests. Once disabling or uninstalling the Plugin takes effect in your IDE, it stops future Plugin execution, without undoing previously completed operations or deleting information already held elsewhere.

You control the project files and local settings in your environment. Where applicable law grants rights concerning personal data, you may contact the Provider about processing for which the Provider is responsible. For information held by a registry, repository host, IDE service or another provider, contact that provider under its privacy terms. Nothing in this notice limits mandatory data-protection rights.

## 8. Changes and contact

This notice may be updated to reflect changes in the Plugin's data handling. Updates do not change the license terms governing an acquired release or retroactively authorize new processing. The notice version and update date identify the description you are reading.

For questions about the Plugin's data handling, contact hello@if-else.dev.