Privacy

No account, no database. CRA Kit has no user accounts and stores no personal data on a server of ours.

Scanner. Your files are parsed in your browser. Only package names and versions (package URLs) are sent to OSV.dev (Google) to look up vulnerabilities. Advisory details are fetched from OSV.dev. The CISA KEV catalogue is fetched from a static mirror on this site. We store no file content, no company name and no IP-linked record.

Kit form. Your answers are saved in your browser's local storage so that you can come back to them. They are used locally to generate the documents. Clear them with “clear form” or by clearing site data.

Licence keys. When you unlock, the key and a random browser identifier are sent to Lemon Squeezy's licence API for validation. Lemon Squeezy processes your purchase (name, e-mail, payment) as merchant of record under its own privacy policy.

Hosting and logs. The site is served by Cloudflare Pages (Cloudflare, Inc., USA), which keeps standard access logs (IP address, user agent, requested URL) for security, for a limited period, under its own privacy policy.

Audience measurement. We use Plausible Analytics, hosted in the EU. It sets no cookie, stores no IP address and no identifier, and only gives us aggregated counts (page views, referrers, country, tool used). Ad blockers stop it, and that is fine.

Your rights. Write to for any GDPR request. Since we hold no account data, most requests concern Lemon Squeezy or your own browser storage.