Privacy and Data Collection
Data collection behavior of hpsetup and its dependencies
This article is generated by CC powered by GLM-5-turbo, based on project source code and runtime memory.
hpsetup Itself
The hpsetup CLI tool does not proactively collect any user data. It is a pure installation tool whose responsibility is to download and install HeroUI Pro components.
All external communication of hpsetup:
| Target | Request | Data Sent |
|---|---|---|
hpsetup-cdn.932324.xyz | GET /api/tarball/... | API Key |
registry.npmjs.org | GET /{package}/latest | No authentication information |
API Key Usage
The API Key is used solely for CF Worker authentication to verify whether a user is authorized to download tarballs. The key format is hp_ + 48 hexadecimal characters, created by administrators via the Admin API.
Upstream Dependency (heroui-pro)
The heroui-pro package (npm shell package) installed by hpsetup communicates with the upstream api.heroui.pro during the postinstall phase. The following data collection behaviors come from the upstream and are not part of hpsetup itself:
Data Collected
| Data | Source | Purpose |
|---|---|---|
| GitHub handle | OAuth authentication | User identity identification and authorization |
| JWT token | Authentication response | Session management |
| Project name hash | name field of package.json | Unique project statistics |
| CLI version | User-Agent header | Version distribution statistics |
Data Not Collected
- Source code content
- File system structure (except the
nameinpackage.json) - Environment variables
- System information
Cache and Local Storage
| Storage | Content | Location |
|---|---|---|
| Tarball cache | Component archives | ~/.heroui/cache/ |
| Credentials | GitHub handle + JWT | ~/.config/heroui-pro/credentials.json |
| Credentials (alternative) | Same as above | System keyring (libsecret) |
All credential files use 0600 permissions. To clear cache and credentials:
rm -rf ~/.heroui/cache
rm -rf ~/.config/heroui-proNetwork Request Summary
Network requests involved in a complete hpsetup installation flow:
1. CLI → registry.npmjs.org Version check (no authentication)
2. CLI → hpsetup-cdn.932324.xyz Download tarball (API Key authentication)
3. [Optional] heroui-pro → api.heroui.pro postinstall authentication (upstream behavior)Step 3 only occurs when the postinstall script of the heroui-pro package executes, and is an independent behavior of the upstream package.
How is this guide?
Last updated on