Privacy Policy

Dependa — Sumikko Lab | Last updated: November 3, 2026

1. Introduction

This Privacy Policy explains how information is handled in the desktop application "Dependa" (hereinafter "the App").

2. Information We Do Not Collect

The App does not collect any of the following:

• Personal information such as names, email addresses, or phone numbers
• Location data
• Usage statistics or telemetry
• Cookies or tracking information
• Project source code

3. Information Stored Locally

The App stores the following information locally on your device. No data is sent to external servers, except the data described in Section 4 when the user enables an online feature.

• App settings: Language preference, online feature toggle, terms acceptance status
• License state: Free / Pro status
• Project, review, policy and exception records: project information, review status, organization policies, exceptions, and snapshots of the previous scan
• Scan results: SBOM files and HTML reports (saved to user-specified output locations)

Storage location: under %LocalAppData%\Dependa\ (settings.json, dependa.db, snapshots\, sbom-reviews\, policies\, dependa-exceptions.json, and so on)

4. Network Communication for Online Features

The App includes optional online features. All online features operate only when explicitly enabled by the user.

4.1 OSV API (Vulnerability Lookup)

• Endpoint: https://api.osv.dev/ (OSV database operated by Google)
• Data sent: Package name, version number, ecosystem name (e.g., PyPI, npm)
• Purpose: Matching against the latest known vulnerability data
• Personal information sent: None

4.2 PyPI API (License Metadata)

• Endpoint: https://pypi.org/ (Python Package Index)
• Data sent: Package name, version number
• Purpose: Supplemental license information retrieval
• Personal information sent: None

4.3 npm Registry and NuGet API (License Metadata)

• Endpoints: https://registry.npmjs.org/, https://api.nuget.org/
• Data sent: Package name (for NuGet, the version number may be included)
• Purpose: Supplemental license information retrieval
• Personal information sent: None

4.4 CISA KEV Catalog (Known-Exploited Check)

• Endpoint: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json (public catalog of the US CISA)
• Data sent: None (the App only downloads the public catalog; package names, file contents, and SBOMs are not sent)
• Visible to the server: Your IP address and the App identifier (Dependa/version number)
• Purpose: Checking whether detected vulnerabilities are listed in the catalog
• Default state: Off
• How to turn on: In the Settings screen, turn on "Use the known-exploited check (CISA KEV)". In the CLI, add --use-kev to scan.
• Requirement: A Pro license is required.
• When the App connects: When a scan runs. By default, the App does not connect if it has a stored catalog fetched within the last 24 hours.
• Storage location: %LocalAppData%\Dependa\cache\kev-catalog.json
• How to delete: In the Settings screen, select "Clear the KEV cache".

4.5 FIRST EPSS API (Exploit Prediction Score)

• Endpoint: https://api.first.org/data/v1/epss (public API of FIRST)
• Data sent: Only the detected CVE IDs (package names, version numbers, file paths, file contents, and SBOMs are not sent)
• Visible to the server: Your IP address and the App identifier (Dependa/version number)
• Purpose: Getting an estimate of the probability of exploitation within the next 30 days (for reference)
• Default state: Off
• How to turn on: In the Settings screen, turn on "Use the exploit prediction score (EPSS)". In the CLI, add --use-epss to scan.
• Requirement: A Pro license is required.
• When the App connects: When a scan runs. The App does not connect if no CVE ID is detected. CVE IDs with stored data fetched within the last 24 hours are not sent.
• Storage location: %LocalAppData%\Dependa\cache\epss-cache.json
• How to delete: In the Settings screen, select "Clear the EPSS cache".

4.6 Disabling Online Features

All online features listed above can be disabled from the Settings screen. When disabled, these features make no network connections. The Store version checks Pro ownership through the Microsoft Store (see Section 5). This check runs whether or not the online features are on.

5. Billing Information

Pro feature purchases are processed through the Microsoft Store platform. Payment information is managed by Microsoft, and the App developer does not directly access any billing data.

6. Third-Party Sharing

The App does not share any collected or generated information with third parties, except that the data described in Section 4 is sent to the listed endpoints when the user enables an online feature.

7. Data Handling During Support

Data provided for investigation purposes will not be used for any other purpose and will be promptly deleted after the investigation is complete.

8. Local Processing

Dependa performs analysis locally and does not transmit source code or project files to external servers. Free features run offline. However, the Store version checks Pro ownership through the Microsoft Store (see Sections 4.6 and 5). Pro features query public vulnerability data sources such as OSV, the CISA KEV catalog, and the FIRST EPSS API only when the user enables the matching online feature.

9. Changes to This Policy

This Privacy Policy may be updated as needed. Users will be notified within the App of any significant changes.

10. Contact

For privacy-related inquiries, please contact:

support@sumikkolab.com