Who we are
Onuri Labs ("we", "us") makes Onuri Antivirus and runs onurilabs.com. You can reach us about privacy at privacy@onurilabs.com.
Onuri Antivirus (the app and CLI)
Scanning happens entirely on your device. We never receive your files, source code or the secrets Onuri finds.
- Dependency lookups. With online checks on (the default), Onuri sends package names and versions from your lockfiles to OSV.dev and to the relevant package registry. You can turn this off with
online = falseor--offline. - Update checks. The app requests
onurilabs.com/api/updates/{os}/{arch}/{version}. Our server sees the app version, operating system, CPU architecture, update channel and your IP address, the same as any web request. - Feedback. If you send feedback from the app, we receive what you wrote, the app version, a timestamp and, if you give one, a reply email address. For false-positive reports we receive the rule ID and optionally a file's SHA-256 hash, never its contents. Diagnostics (OS, version, architecture and similar) are included only if you tick the box. You see the exact JSON before it's sent.
- No telemetry. The app doesn't send analytics, usage statistics or crash reports on its own.
This website
onurilabs.com uses no analytics, advertising or tracking scripts, and loads no third-party resources. Our host and our CDN (Cloudflare) process standard server logs (IP address, user agent, requested URL, time) to deliver the site and protect it from abuse.
Cookies
We don't set cookies. Your theme choice (light or dark) is saved in your browser's local storage and never sent to us. Cloudflare may set a strictly necessary security cookie (such as __cf_bm) to tell people from bots. That's why there's no cookie banner.
If you email us, we use your address and message only to reply. We don't add you to marketing lists without your explicit consent.
Service providers
| Provider | Purpose |
|---|---|
| Cloudflare | DNS, CDN, TLS and DDoS protection for onurilabs.com |
| Hostinger | Website hosting and email |
| OSV.dev (Google) | Vulnerability lookups, sent directly from your device when online checks are on |
Retention
Server logs are kept for up to 30 days. Feedback reports and support emails are kept as long as needed to resolve the issue, then deleted within 12 months unless you ask us to keep them. Reports can be deleted at any time on request.
Your rights
Depending on where you live (including under the GDPR and UK GDPR and the CCPA), you can ask to access, correct, delete or export the personal data we hold about you, or object to how we use it. Email privacy@onurilabs.com and we'll answer within 30 days. You can also complain to your local data protection authority.
Changes
If we change this policy in a meaningful way, we'll update the date above and note it in the changelog. We will never start collecting telemetry without asking you first in the app.