What we collect, and what we don’t

You can browse the feed, every product page, every release and the search results without signing in. Doing so sets no cookie and stores nothing about you in our database.

We measure aggregate traffic with Vercel Web Analytics and Vercel Speed Insights. Both are cookieless and neither builds a profile across sites. Search terms are stripped before anything leaves your browser — the address bar carries your query while you type, and it is removed from every URL and every event we send. Reading and searching record nothing you typed.

One feature departs from that, and it is the only one: the manifest importer below, which you operate deliberately by pasting a file. It stores the names of public packages a registry confirmed, and nothing else from what you pasted.

Some of those measurements are made by our server rather than by your browser, because the pages where you follow a product, watch a term or change a notification setting work without JavaScript and there is nothing in the browser to measure. Those carry what happened and never who did it: no identifier, no email address, no product name, no watched term, and no cookie — your session cookie is dropped before the measurement is sent.

Signing in is optional and exists to unlock nine things: following products, a personal feed, browser notifications, a daily email, keyword watching, commenting, reacting to releases, recommendations based on what you already own or watch elsewhere, and importing a dependency manifest. We support Google, GitHub, GitLab and Steam, and we ask each for the minimum identity scope.

From the provider we store your name, email address, and avatar URL. Steam does not return an email at all, so a Steam sign-in gets a synthetic unusable address instead. We also store the session itself — its expiry, the IP address it was created from, and the browser’s user-agent string — which is what lets you stay signed in and lets a session be revoked.

You can connect more than one provider to the same account. Doing so attaches the second identity to the account you are already signed in as; it never merges two accounts, and an identity already attached somewhere else is refused rather than moved.

The provider also hands us OAuth tokens, which we store because the authentication library’s schema declares them. One feature reads them. The recommendations page asks GitHub which repositories you star and watch, and asks Steam which games your account owns, so it can show you which of those we already track. Nothing reads a Google or GitLab token — those are stored because the schema has a column for them and used for nothing after you sign in. We never post anywhere as you, and we never write anything to a provider.

Both reads happen while that page is loading, and only when you open it. The answer is matched against our catalog, rendered, and thrown away. We store no part of your game library or your repository list. Steam replies at all only if the game details on your Steam profile are public, and nothing you do here changes that setting.

Claiming a product is a separate authorization, and it does not touch the token above. If you tell us you publish a product, we send you to GitHub to approve a one-time request, then ask GitHub whether your account administers that repository. We keep the answer and the repository name. We do not store the credential it gives us: it is used inside that one request and thrown away, and we never learn your GitHub username from it.

We do not use passwords, we do not send marketing email, and we do not sell or share any of this.

Accounts are for people aged 13 and over, and the site is not directed at children. We do not knowingly collect anything from someone younger. If we learn that an account belongs to a child under 13 we delete it and everything attached to it; if you believe that has happened, write to us at the address below and we will handle it.

There are two ways to hear from us, both off until you turn them on: a notification in your browser as a release arrives, and one email a day. You can take either, both, or neither, and each can carry releases from the products you follow, mentions of the terms you watch, or both.

The daily email goes to the address your sign-in provider gave us, and only if that address is verified. It names the releases and mentions since the last one we sent you, links to them, and carries a one-click unsubscribe link that works without signing in. If it hard-bounces or you report it as spam, we stop sending it and record which of those two happened, so the settings page can tell you why it stopped.

If you turn on browser notifications, your browser gives us a delivery address for itself — a long URL at Google, Mozilla, Apple or Microsoft, depending on your browser — plus two encryption keys it generates. We store those three values against your account, along with a short label like “Firefox on Linux” so you can tell your devices apart in the list.

That address is what a notification is sent to, and it is the only thing it is ever used for. It is stored per browser, not per person: turning notifications on in two browsers stores two entries, and turning them off in one leaves the other working.

The contents of a notification are encrypted to keys only your browser holds. The push service that carries it — Google, Mozilla, Apple or Microsoft — routes it without being able to read it. What that service can see is that we sent something to your browser, and when.

We only tell you about products you have chosen to follow and releases that mention a term you have chosen to watch — on whichever of the two channels you switched on. Watched terms are stored against your account, shown back only to you, and never written to our logs or sent to our analytics, on either channel. Turn it all off at any time on your account page, or in your browser’s own site settings. Deleting your account deletes these entries with everything else.

Comments are public. Anyone who can read the page can read what you wrote, along with the display name and avatar shown beside it.

Your display name is separate from the name your provider gave us, and you control it. Google in particular returns legal names, so we default your public name to it but let you change it at any time on your account page. Your email address is never shown on the site.

Comment threads are deliberately not indexed by search engines and are not included in our sitemap, RSS feed or machine-readable exports. They load only for a reader who opens the page.

Reacting to a release — “went fine” or “broke things” — is public only as a total. The page shows how many people picked each answer and nothing about who; there is no surface, human or machine, that lists reactions by account. The endpoint serving those totals answers identically for every reader, signed in or not, which is what makes showing your choice back to you a separate, private request.

Following a product is private. Nothing on a product page reveals who follows it, or how many people do.

A claim is public; the person behind it is not. A claimed product carries a badge and one line naming the repository we checked and the date we checked it, so a reader can judge the badge rather than take it on trust. Your name, your account and your email are not part of it, and there is no surface that lists who claimed what. Deleting your account removes the claim with everything else.

The importer takes a package.json, Brewfile or requirements.txt you paste and shows which of those dependencies we already track. The file itself is never stored. It is read while the request runs — no versions, no comments, no lines we did not understand — and thrown away with the response.

Matching happens on our own server against our own catalog, and by itself it sends nothing anywhere. Dependencies that declare a private source — a workspace, a file path, a Git URL, an internal index — are discarded before anything else looks at them.

The names left over are the ones we do not recognise, and you decide what happens to them. Only if you press the second button do we ask npm, PyPI and Homebrew whether those names are public packages — which means sending them to those registries. We keep the ones a registry confirms; a name none of them has, or one we could not check, is not stored at all.

What we keep of a confirmed name is the name and the fact that your account listed it. It is read as one number: how many accounts depend on a package, which is how we decide what to add to the catalog next. Nothing shows other readers what you use, and deleting your account deletes your half of that count.

Posting a comment or suggesting a product is rate-limited per account and per network. To count requests from one network without keeping addresses, we store a salted one-way hash of the IP address and never the address itself. The hash is a counting key: it is never displayed, never joined to your account, and never written to a log.

New comments are checked automatically for the patterns that characterise spam. A comment that trips one is held for a human to look at rather than deleted — nothing on this site is removed by an automated decision alone.

We use Vercel BotID on the endpoints whose writes shape what other readers see — suggestions, comments, reactions, and the manifest importer’s registry check — to tell a browser from a script.

We run on other people’s infrastructure, and these are all of them:

• Vercel — hosting, plus the analytics described above.
• Neon — the Postgres database everything is stored in.
• Google, GitHub, GitLab or Steam — whichever ones you chose to connect, at the moment you sign in or connect them. GitHub and Steam are also contacted, with the identifier they issued you, each time you open the recommendations page. GitLab is contacted only at sign-in.
• Whoever hosts a profile picture — Google, GitHub, GitLab, Steam or Gravatar — avatars are served from the provider that issued them rather than copied onto our servers, so the browser showing a comment fetches that image straight from them. That host sees the reader’s IP address and that they were on this page. This applies to everyone reading a thread, not only to the person whose picture it is. Six hosts are permitted to serve an image at all, and our content security policy is what holds the list to six.
• Gravatar — asked once, at sign-in, and only for an account whose provider returned no picture. We ask whether a Gravatar exists for a hash of the email address, never for the address itself, and we ask it to answer plainly rather than invent a placeholder. If there is none, nothing is stored and you get a monogram we draw ourselves.
• Anthropic — the text of a comment may be sent to the Anthropic API to be classified as spam or not. This is the only place user-written text leaves our infrastructure. It is not used to train a model.
• Resend — email delivery. Two kinds of mail go through it: notices to this site’s own operator when someone suggests a product or the data pipeline breaks, and the daily email described above, which you receive only if you asked for it. We do not email you otherwise, and every daily email carries a one-click unsubscribe link.
• Google, Mozilla, Apple or Microsoft, whichever runs your browser’s push service — and only if you turned on notifications. Your browser picks which one; we do not. They carry the notification without being able to read it, because it is encrypted to keys only your browser holds.

Vercel and Neon both run in the United States, so everything stored here is stored and processed there, wherever in the world you are reading from.

Server logs record what the site did, not what you said. A refused comment logs a reason code and a length; a search logs an outcome; a manifest import logs how many dependencies it read. Text you typed never becomes a log field, and neither does the salted network hash. That holds for the registry check too — those requests carry package names in their addresses, so the server records only which registry it asked.

Your account page has a delete button, and it is a real delete rather than a deactivation. It removes your account row and, with it, your sessions, your linked provider identities, your subscriptions, the terms you watch, the marker for when you last checked your personal feed, the notification addresses of any browsers you set up, your comments, the releases you marked as fine or broken, the package names any manifest you imported contributed, and any reports you filed. There is no copy kept behind it and no restore.

You can also delete a single comment yourself. A deleted comment keeps its place in the thread as a marker so replies to it still make sense, but its text is erased.

Anonymous product suggestions are keyed to a browser cookie rather than an account, so they are not attached to you and cannot be individually identified for deletion. Clearing your cookies for this site disconnects your browser from them.

Account data and comments stay until you delete them. Sessions expire on their own. The rate-limit hashes are only ever read for a window of an hour or a day, and are removed with the rows that carry them.

Erasure is the one we built rather than described: the delete button on your account page removes everything listed above in one step, with no queue and no waiting period. Your public name is editable on the same page, which covers correction of the only field anybody else sees.

For anything the buttons do not reach — a copy of what we hold, a correction to something else, an objection, or a question about how a rule applies to you — write to contact@whatsnew.fyi. Where the law gives you a right we have not automated, ask and we will do it by hand.

This site is run by one person. If something here is unclear, or you want data removed and the delete button did not cover it, email contact@whatsnew.fyi. It reaches Jeff Mixon, not a queue.

What you may and may not do with the site — and what happens to a comment once you post it — is the other half of this pair: the terms of service.

If this policy changes in a way that affects what we collect or who sees it, the change will be described here rather than made quietly, and the date at the top will move.