{"version":"1.0","effective_date":"2026-04-23","data_collected":{"ip_hash":"SHA256(IP+salt) — one-way, no reverse mapping","user_agent":"string (max 500 chars) — classified into agent_client bucket","endpoint":"which API endpoint was called","ecosystem+package_name":"what package you asked about","country":"2-letter code (from CDN, coarse)","status_code":"200/404/5xx","timestamps":"UTC timestamp of call"},"data_NOT_collected":["raw IP address (never written to disk)","email, name, or any personal identity","cookies, device IDs, fingerprints","package source code or private metadata"],"retention":{"raw_rows_api_usage":"30 days","aggregated_insights":"indefinite (anonymized)"},"rights":{"access_export":"GET /api/gdpr/export","erasure":"POST /api/gdpr/delete","rate_limit":"10 requests/hour for GDPR endpoints"},"contact":"privacy@depscope.dev"}