Privacy policy

This policy explains what personal data Dynamo Maritime Ltd ("we", "us") collects through this website and our software, why, and what you can do about it. We are the controller of that data. Our details are at the end.

The short version: Seaworthy never sends us your code. This website uses no cookies, analytics or trackers. We collect only what we need to sell you a licence, check it and help you.

This website

We don't use cookies, analytics or advertising tools, and the site loads nothing from other companies. Our hosting provider, Google (Google Cloud), processes technical data such as your IP address and browser type to deliver the pages and protect the service.

Buying a plan

Polar Software, Inc. ("Polar") is our merchant of record: it is the seller on your receipt, takes the payment and handles tax. Polar collects your name, email address, billing address and payment details under its own privacy policy. We never see your full card details.

Polar shares with us what we need to run your licence and help you: your name, email address, country, what you bought, and the state of your subscription and licence key.

Using Seaworthy

Seaworthy runs on your computer. It reads your project there. It never sends your code anywhere, and never sends your findings or file names to us.

Two checks look up your dependencies online, as installing them would. They send data straight from your computer to public services, not to us:

• the known-vulnerabilities check sends the names and versions of your packages to OSV (osv.dev), Google's open vulnerability database;
• the made-up-package check sends package names to the public npm registry (registry.npmjs.org), as npm install would. It skips packages from a private registry and your own workspace packages.

Those services also see the IP address the request comes from. Run Seaworthy with --offline to skip both checks.

Licensing makes no network connections in the free version. If you have a paid plan, Seaworthy contacts Polar's licence server when you log in or out, and at most once a day after that, sending only:

• your licence key;
• a machine label: your computer's name, or a label you choose with --label;
• the activation ID the licence server gave this machine.

Polar also sees the IP address the request comes from. Your licence is saved on your own computer, in your user settings folder.

Pro history files stay in your project, on your machine, and hold only rule IDs, file paths, line numbers, severities and times.

If you set up Pro alerts, Seaworthy sends each finding's rule, title, severity, file path and line to the Slack channel, webhook or email address you choose, never code or secrets. That goes to your own destination, not to us. Pull-request checks put a summary on your own pull request, through your GitHub workflow.

Emailing us

If you email us, we keep your message and our reply so we can help you and look back at past issues. Our email is provided by Google Workspace.

Why we use your data (lawful bases)

• Contract: to provide your licence, check it and give support.
• Legitimate interests: to keep the website and licence system working and secure, and to stop keys being shared beyond their plan.
• Legal obligation: to keep financial records.

We don't sell your data, use it for advertising or use it to train AI models.

How long we keep it

Order and licence records are kept for six years after the end of the financial year they relate to, as UK tax law requires. Support emails are kept for up to two years after the conversation ends, unless they relate to an open issue.

Who else processes it

• Polar (merchant of record, payments and licence keys).
• Google (website hosting and email).

OSV and the npm registry aren't on this list because they don't process data for us. Seaworthy contacts them directly from your computer, and they handle requests under their own policies.

These providers may process data outside the UK. Where they do, they rely on legal safeguards such as the UK International Data Transfer Addendum or standard contractual clauses.

Your rights

Under UK data protection law you can ask for a copy of your data, ask us to correct or delete it, object to or restrict how we use it, and ask to move it to another service. Email support@dynamomaritime.com. We'll reply within one month.

If you're unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk. We'd appreciate the chance to put it right first.

Changes

If we change this policy, we'll update the date at the top. If a change affects how we use data we already hold, we'll email customers first.

Contact

Dynamo Maritime Ltd, 82 James Carter Road, Mildenhall, England, IP28 7DE. Company number 17152743. Email support@dynamomaritime.com.