Privacy

No account, no personal data. CRA Kit has no user accounts and stores nothing you type on a server of ours. We do run one database, the visit counter described below. It holds anonymous events only: no cookie, no IP address, no browser identifier.

Scanner. Your files are parsed in your browser. Only package names and versions (package URLs) are sent to OSV.dev (Google) to look up vulnerabilities. Advisory details are fetched from OSV.dev. The CISA KEV catalogue is fetched from a static mirror on this site. We store no file content, no company name and no IP-linked record.

Kit form. Your answers are saved in your browser's local storage so that you can come back to them. They are used locally to generate the documents. Clear them with “clear form” or by clearing site data.

Licence keys. When you unlock, the key and a random browser identifier go to a small function on this site, which asks Creem whether the key is valid. We keep no record of it. Creem (Armitage Labs OÜ, Estonia) processes your purchase (name, e-mail, payment) as merchant of record under its own privacy policy.

Hosting and logs. The site is served by Cloudflare Pages (Cloudflare, Inc., USA), which keeps standard access logs (IP address, user agent, requested URL) for security, for a limited period, under its own privacy policy.

Audience measurement. We count visits ourselves, on our own Cloudflare database located in the EU. No cookie, no third party. Your browser sends us the page, the language, the referring site and the tool used (test, scan, preview, purchase). We keep no IP address and no browser identifier: a daily hash that cannot be reversed lets us count visitors, and it changes every day. We honour Do Not Track and Global Privacy Control. Ad blockers stop it, and that is fine.

Your rights. Write to [email protected] for any GDPR request. Since we hold no account data, most requests concern Creem or your own browser storage.