The desktop app and CLI
The core scan is static analysis running entirely on your own computer. It reads your files, builds a dependency map in memory, and reports the result locally.
- No data collection. No telemetry, no analytics, no crash reporting, no usage pings.
- No account required. The scanner works with no sign-in of any kind.
- Your source code is never transmitted during a normal scan. There is no RippleCheck server to transmit it to.
Two optional features that do use the network
Both are off unless you turn them on, and neither routes through any RippleCheck infrastructure.
GitHub sign-in (desktop app only)
The desktop app has an optional repository browser. If you use it, you sign in to GitHub through standard OAuth so the app can list your repositories and scan one without you cloning it by hand first. This is a feature of the app on your machine — this website has no login and no accounts. For exactly what the app requests and stores, see the README.
AI enrichment (bring your own key)
If you supply your own API key, the app can send a finding to the provider you chose to generate a plain-English summary and a refined fix prompt. The key is stored encrypted at rest via Electron's safeStorage. Requests go directly to that provider and never to a RippleCheck server, because there isn't one. With no key configured, enrichment is skipped and the deterministic output is unchanged.
When you use either feature, your data is handled by GitHub or by your chosen AI provider under their privacy terms. RippleCheck is not in the middle of it.
This website
- No cookies are set.
- No analytics or tracking scripts run.
- There is no login, no account, and no form that collects personal data.
- Fonts load from Google Fonts, and animation libraries load from cdnjs. Those requests reach Google and Cloudflare and are subject to their policies.
- Download buttons link directly to GitHub Releases, so the download itself is served by GitHub.
Verifying any of this
RippleCheck is MIT-licensed and the full source is public. If you would rather confirm these claims than take them on faith, read the code or watch the network traffic — both are legitimate ways to check.
Questions about any of this: team@ripplecheck.io