lookupd

Privacy

lookupd is operated from Singapore. Contact: hello@lookupd.com. This page follows Singapore's Personal Data Protection Act (PDPA) and, for visitors in the EU and UK, the GDPR.

Waitlist emails

Page-view logging

Our servers log each page request: path, format (html, md or json), status, user-agent family, country, and referrer host. Page views store no IP address and no hash of it, and we set no tracking cookies.

Cookies

lookupd sets no tracking cookies of its own. One short-lived cookie is used only during GitHub sign-in, which a publisher starts to prove they control a listing. It holds a random value that ties the sign-in to that browser, is sent only to /register/github, and is deleted when sign-in finishes or after 10 minutes. Google Analytics, described below, sets its own cookies outside the regions where consent is required.

Analytics

When configured, public pages (never the claim pages under /register) load Google Tag Manager, which runs Google Analytics 4. It runs with advertising features off and IP anonymization on. In the EEA, the UK and Switzerland it runs without analytics cookies, since consent is not asked for; elsewhere it sets Google's _ga cookies to tell visits apart. The site may also load the Cloudflare Web Analytics beacon, which is cookieless. Both are omitted when not configured, and there is no other client-side tracking.

Lookup and telemetry events

Every request an agent makes to the API is recorded as anonymous demand data: the tool or endpoint, its structured parameters (the search phrase truncated to 160 characters, filters, the entry name, URL or package asked about), what it returned, how long it took, the runtime and client family, the optional session id and domain tag, and, from CLI 0.3.0 while telemetry is on, a random install id the CLI made up once (lookupd telemetry reset replaces it) so repeat use can be counted. Never prompts, task text, file paths or output. See Telemetry policy.

To count distinct callers and apply rate limits, a salted hash of the IP address that rotates daily is stored with lookup and telemetry events (SHA-256 of the UTC date, a secret salt and the IP). The raw IP address is never stored, and the hash is removed from events older than 30 days.

Telemetry

From lookupd CLI and plugin version 0.2.0, outcome reports are on by default, with a one-time notice on the first run; turn them off with lookupd telemetry off or DO_NOT_TRACK=1. A report holds structured fields only and never prompts, task text, file paths or output. An optional hook (lookupd hooks install, never installed by itself) reports which server and tool an agent called and whether the call succeeded, under the same limits. See Telemetry policy.

Your rights

You may ask to access, correct or delete data we hold about you. Email hello@lookupd.com. We reply within 30 days.