Privacy Policy.

Depcura is a Windows desktop application published by KASAM Corporation. It is designed to run locally on your machine. Scanning, parsing, rule evaluation, health scoring and reporting are fully offline operations. Depcura requires no account, no subscription, no telemetry, no analytics, no advertising and no user tracking.

Depcura does not collect or transmit any telemetry, usage analytics, crash reports, device fingerprints, or behavioural data. There is no background service that phones home. The application does not contain any software that monitors your activity across other applications.

Depcura does NOT transmit:

• source code, file contents or file paths;
• project names, repository names or remote URLs;
• usernames, machine identifiers or personal data;
• scan results, findings, health scores or action plans;
• manifest contents or lockfile contents;
• advisory pack contents.

Only exact resolved package versions are ever sent to external advisory sources (see Section 5), and only after you explicitly grant consent.

Depcura can optionally look up public advisory and registry metadata from official sources. This is governed by an explicit consent gate with three modes:

• OFF (default): no network request is ever issued.
• CHECK ONCE: authorises exactly one enrichment operation, then automatically reverts to OFF.
• ALWAYS: authorises enrichment until you revoke it.

Revoking consent takes effect before any new request is issued. Consent is consumed atomically (a single SQLite BEGIN IMMEDIATE transaction) and reverted to OFF before the request is issued. Two concurrent operations can never both consume the same one-time consent.

When you grant consent, Depcura sends only the minimum needed to look up public metadata:

• Vulnerabilities (OSV): the canonical ecosystem, package name and exact resolved version.
• Registry metadata: the package name (and group, where applicable) to the official registry for each ecosystem.

Requests are restricted to a fixed allowlist of official HTTPS origins (OSV, npm, PyPI, crates.io, NuGet, Go module proxy, Maven Central, Packagist, RubyGems). Redirects are disabled. Non-HTTPS schemes, credentials in URLs, IP-literal hosts, unexpected ports and unapproved hosts are rejected. Timeouts: connect 5 seconds, request 15 seconds. Only exact resolved versions are sent; unresolved version constraints are never submitted as if installed.

Depcura stores the following locally on your machine:

• Scan history and reports: in a local SQLite database.
• Consent mode and settings: in the same local SQLite database.
• Advisory/registry lookup cache: cached locally with time-to-live values (OSV 12 hours; registry 24 hours).

No lookup data is sent anywhere except to the official sources described above, and only with your consent.

Depcura can import advisory packs that you choose to load. These packs are stored locally and are never transmitted to any external service.

Depcura can export reports (HTML, JSON, CSV, PDF). These reports are written to locations you choose on your local machine. Depcura does not upload them anywhere.

You can clear local history, cached lookup results and settings from within the application. Clearing the cache removes all cached advisory/registry records. Revoking consent stops all future online requests. Uninstalling the application removes the local SQLite database and all associated data.

Depcura is distributed through the Microsoft Store. The Microsoft Store and Windows operating system have their own data handling practices, which are separate from and in addition to Depcura's. Depcura's local-first design means the application itself transmits nothing beyond what is described in this policy.

This privacy policy is version 1.0.0, effective 2026-10-23. The current version is always available from within the application and from KASAM Corporation's published documentation.

For privacy questions or requests, contact: