Privacy

The command line tool

It collects nothing and it sends nothing. No telemetry, no version ping, no crash reporting, no licence call home. It reads your working tree, shells out to git, then under --mutate it runs your own test command. That is the whole surface.

You do not have to take that on trust. It is one directory of ES modules with no runtime dependencies, so grep it for fetch and http and see for yourself. The security page lists every process it starts.

The site

The pages you are reading are static files served from a Cloudflare Worker. There is no analytics script, no tag manager, no session recorder and no advertising pixel on any page of this site. View source and the only JavaScript is one module that switches the colour theme, copies a command to your clipboard and, on two pages, loads the sign in SDK.

If you sign in, an email address enters the picture. Tiun holds the account and the payment record. We ask it two questions: is this browser signed in, and has this account bought anything. That answer is what a licence is minted from.

Cloudflare sees the request itself, the way any host does: an IP address, a path, a user agent, a timestamp. We do not build a profile from it and we run no reporting on it.

What is inside a licence

A licence is a signed payload. It carries the product names it unlocks, the account email, the issue time and the expiry. Nothing else. It is signed rather than encrypted, so treat the email in it as visible to anyone you hand the licence to. That is deliberate: a licence that turns up in a public repository is traceable back to the account it was issued for.

Cookies and storage

One key in localStorage, margyn-theme, holding the word light or dark when you pick one. It never leaves your browser and clearing site data removes it.

Sign in and checkout set whatever cookies Tiun's session needs. Those are theirs. They are only set once you sign in, so reading these pages sets none of them.

Who else is involved

Tiun	Authentication, subscriptions and card handling. Holds your email and your payment record. We never receive card details.
Cloudflare	Serves every page and runs the licence endpoint, so it sees the request metadata for any visit.
esm.sh	Delivers the sign in SDK to your browser on the home page and the pricing page, which means it sees your IP address when one of those two pages loads. The other pages do not load it.
npm	When you run npx margyn-scan, npm fetches the package. That request goes to npm rather than to us, so we get no report of it.

Your data, your call

To see or delete what is held about you, the account lives with Tiun, so start there. If a request needs us, open an issue and say what you want done. There is no dataset here to export beyond the account record and the payment history that Tiun keeps.

We do not sell anything to anyone. There is no list, no data sharing arrangement and no third party in the chain beyond the four named above.