timaub's YAML Lint for Drupal — Privacy Policy
Effective 2026-10-30
timaub's YAML Lint for Drupal collects no data. It has no telemetry, no analytics, no crash reporting, and assigns you no identifier. The rest of this page is the proof.
What the extension accesses
| Access | What | Why |
|---|---|---|
| Read | Drupal YAML files in the open workspace (*.routing.yml, *.services.yml, *.links.*.yml, *.permissions.yml, *.libraries.yml, *.info.yml), except those matched by drupalYamlLint.exclude | Build the index and compute diagnostics |
| Read / check existence | PHP files at the PSR-4 path of a referenced class (src/…/Name.php, core/lib/Drupal/…), the module's src/Routing/ folder and src/<Name>ServiceProvider.php, and CSS/JS files listed in libraries | Check that the referenced class, method or file exists |
| Write | One CSV file, only when you run Export Report as CSV (Pro), at the path you choose in the save dialog | Export the report |
| Store | Your license key, in VS Code's SecretStorage (the operating system's credential store) | Pro |
| Store | In VS Code's extension storage: the date of the last successful license check (and of the last failed one, to wait an hour before retrying), the activation ID returned by Polar, and the license expiry date if any | Offline grace period, deactivation |
| Network | https://api.polar.sh/v1/customer-portal/license-keys/activate, /validate, /deactivate | Pro license check (see below) |
The extension never writes to your project files, never runs PHP, Drush, Composer or any shell command, and sends nothing about your files anywhere. Your YAML, PHP and asset files never leave your machine.
Without a license key, timaub's YAML Lint for Drupal makes no network request at all.
The only network call: license validation
When you enter a key (activation), and then at most once every 24 hours while a key is stored (revalidation; a check that fails is retried at most once an hour), the extension contacts Polar's license key API. Polar receives:
- the license key;
- the Publisher's Polar organization ID (a public identifier of the seller, not of you);
- on activation, an activation label:
timaub's YAML Lint for Drupal (VS Code)(a fixed text that does not contain your user name or machine name); - on validation and deactivation, the activation ID it created at activation;
- as with any HTTPS request, your IP address and standard connection metadata.
Polar's reply also contains the name and e-mail address you gave at purchase. timaub's YAML Lint for Drupal does not store them.
If the check cannot reach Polar, Pro keeps working for 14 days after the last successful check, using only the locally stored date. After that, Pro rules pause until a check succeeds; nothing is deleted.
Polar's privacy policy: https://polar.sh/legal/privacy
How to verify
The published extension is a single bundled file, dist/extension.js, inside the .vsix (a ZIP archive). It is minified but readable. To list the URLs it contains:
grep -o "https://[^\"' )]*" dist/extension.js | sort -uThe only address the extension calls should be https://api.polar.sh. Bundled libraries may contain other URLs in strings (for example in error messages); they are not requested. You can also watch the extension's traffic with any network monitor: without a license key there is none.
Purchases
Purchases are handled by Polar as merchant of record: it collects your payment details, billing address and e-mail address, under its own privacy policy. The Publisher can see your name, e-mail and order in the Polar dashboard, and uses them only to provide support and handle refunds.
Your rights (GDPR)
- Controller: Timothée Aubourg, 72 avenue des Prés Vendôme, 78450 Villepreux, France — support@timaub.fr.
- Legal basis: performance of the contract (Article 6(1)(b) GDPR) — checking that a license key is valid.
- Recipient: Polar is the only third party involved. No data is sold or shared with anyone else.
- Retention: on your machine, the license key and check dates stay until you run timaub's YAML Lint for Drupal: Deactivate License, which deletes them. Run it before uninstalling: VS Code may keep extension storage after an uninstall. Purchase records are kept by Polar and by the Publisher as long as required by tax law.
- Rights: access, rectification, erasure, restriction, objection and portability. Write to support@timaub.fr. You can also complain to the CNIL (https://www.cnil.fr).
Changes to this policy will be listed in the changelog.