Privacy
Reading pkg.futureblitz.dev and adding packages with fb needs no account, and the registry
keeps no more about a visit than Cloudflare does to serve it and count it, as Visiting says. An account keeps what this page
lists, and no more.
Visiting
- Cloudflare’s handling. The registry runs on Cloudflare, which handles each request, with its IP address and headers, to serve it and keep the registry up, under Cloudflare’s privacy policy. The API counts requests per address for its rate limits, and forgets them within a minute.
- Downloads. Each archive downloaded counts once for its package, version, and target, with nothing about who downloaded it; the counts are what package pages show.
- Counting visits, without tracking. Cloudflare Web Analytics counts page views and how fast pages load, with a script from static.cloudflareinsights.com that sets no cookie, keeps nothing in your browser, and doesn’t fingerprint you; it sends what it counts to this site, where Cloudflare reads it, under Cloudflare’s privacy policy. No ads. The only other script from another site is Cloudflare Turnstile’s, which loads when you start making an account on the sign-in page. The fonts are served from this site.
- Readme images. A package’s readme may show images from other sites, such as badges, which your browser fetches from them, sending this site’s address as the referrer, not the page’s.
An account
- Who you are: your username; your email address, if you signed up with one or GitHub gave a verified one, and whether it’s verified; and, if you sign in with GitHub, your GitHub login and its numeric id. Your username, your GitHub login, when you joined, and the packages you own are public, on your page, and so are the teams you’re in, with your role in each, on theirs.
- How you sign in: each passkey’s public key, its name, and when it was last used; never a password, since there are none. Recovery codes and API tokens are kept only as their SHA-256 hashes, and shown once.
- Sessions: one cookie,
__Host-fb_session, set when you sign in, readable only by this site’s server (HttpOnly, Secure, SameSite=Lax), for 30 days or until you sign out. Signing in with GitHub sets a second, for ten minutes, to check GitHub’s answer. That’s all the cookies there are, so there’s no cookie banner. - Sign-up’s check: making an account with an email runs Cloudflare Turnstile, which checks the browser is a person’s under Cloudflare’s privacy policy. Its script loads only once you start filling in the sign-up form.
- The audit log: every change to an account, a package, a team, or a token is logged with who made it and when, for the account, its packages’ owners, and its teams’ owners to see. A version’s publisher is public, on the package’s page.
- Mail: the registry mails you to verify an address, to sign in by link, and when one of your packages is published, or you’re invited to own a package or to join a team. Nothing else, and never anyone else’s mail.
Deleting an account
Deleting your account from the dashboard deletes its email address, its GitHub login and id, its passkeys, sessions, tokens, and recovery codes, and its ownership of packages and teams at once. Its username stays reserved, so no one else takes it, and the audit log and the versions it published still name it, since a package’s history is its users’ to check.
Changes
When this policy changes, this page changes.
Contact
Questions about these policies, and reports, go to a new issue on FutureBlitz's GitHub, which is public. A report that shouldn't be public goes to GitHub's private vulnerability reporting on FutureBlitz's repository, which only its maintainers see. The registry has no email address for them.