Last updated 3 September 2026
Flagrante is a tool for people who are about to be held to a European regulation. It would be absurd to run it on a site that quietly did the opposite of what it preaches, so this page is specific rather than generic, and short enough to actually read.
Your SBOM is never stored. When you scan one here it is parsed
in memory, checked, and dropped when the request ends. It is not written to disk,
not logged, not retained, and not sent anywhere else. There is no storage layer in
the scanner at all, so there is nothing there to leak, subpoena, or breach. If you
would rather it never left your machine, pip install flagrante does
exactly the same thing locally.
Flagrante is operated by an individual, not yet a company. For anything on this page — access, deletion, objection, or a question — write to privacy@flagrante.dev. That address is read by a person, and it is the same person who would fix whatever you report.
| What | Why | Legal basis | Kept |
|---|---|---|---|
| Your email, if you join the waitlist | To write to you once when the continuous version exists, and once more if the price changes before then. Nothing else. | Consent — you typed it in and pressed a button | Until you ask us to delete it, or until the project is abandoned |
| A random number stored in your browser | To tell a returning visitor from a new one. Whether people come back is the single measurement this experiment turns on. | Consent — asked before it is set, and the site works identically if you decline | 13 months, or until you clear it |
| Country and referring site, when that number is set | To know which channel and which countries this reaches. Country comes from Cloudflare; only the referring host is kept, never the full URL. | Consent, with the above | 13 months |
| Two optional survey answers after a scan | To learn what kind of company this is actually for. Stored with the counts from your scan, never the component list. | Consent — the questions are optional and skipping them changes nothing | Until the project is abandoned |
In a Cloudflare D1 database with its primary location in Western Europe. That was a deliberate choice: most of the people this is built for are EU manufacturers, and it would be strange to sell European compliance while keeping European data somewhere else. Cloudflare processes it on our behalf and does nothing else with it. Nobody else receives it, and it is never sold, shared, or used to build a profile.
If you are in the EU or UK you can ask for a copy of what we hold, ask for it to be corrected, ask for it to be deleted, withdraw consent, or object. In practice there are two ways, and the first one is instant:
Checking what is stored for this browser...
This erases the random number from your browser and deletes the matching row from the database. No email, no ticket, no waiting. It cannot delete a waitlist entry, because that is tied to your email address rather than to this browser.
For anything else — a copy of your data, deleting a waitlist entry, or a complaint — write to privacy@flagrante.dev. We will answer within 30 days, which is what the GDPR requires, and normally much sooner because there is very little data to look through.
You also have the right to complain to your national data protection authority if you think we have got this wrong.
If this page changes materially, the date at the top changes with it, and anyone on the waitlist gets told. This site is open source, so the full history of this page is public and you can check what changed rather than take our word for it.