NVM for Windows
Author Software Inc
Effective October 3, 2026
This policy describes how Author Software Inc, a Texas corporation (“Author”), handles personal information in connection with nvm-windows.com (the “Site”) and both builds of NVM for Windows: the community build and the certified build. It also covers the customer portal, license checks, and the Author Mirror, which are part of the certified build only. Contact [email protected].
The community build is not sold under the End User License Agreement. For the certified build, that agreement controls what the Software does. This policy controls how Author handles personal information Author actually receives, whether from the Site or from the Software. If the two conflict on what the certified build does, the End User License Agreement controls.
Community build. The community build runs on the user’s computer. It downloads Node.js from the public mirror the user configures. The default is https://nodejs.org/dist. That download is between the user and that site. The community build does not include the Author Mirror, hosted rules, or license checks against Author hosts. A community install does not send the user’s source code, proxy credentials, directory identifiers, or machine identity to Author. If the user emails [email protected], Author receives that message and the sender’s email address.
Certified build. The certified build is the paid Software. Sections 2 through 5 apply to a certified customer. The Author Mirror, hosted rules, and verbose license metadata exist only on a certified build with Governance, and only if that customer turns them on. A certified install with those features off stays on the customer’s computers, the same as a community install: Author does not receive proxy credentials or local allow and block lists.
Author does not host customer source code, project files, or application runtime data. Author is not a processor of that material.
Author does not store customer card numbers. Card and ACH details are entered with Stripe at checkout. Stripe stores the payment record under Stripe’s terms.
Do not send protected health information or classified information to Author. The Software is not a HIPAA system, and this policy is not a business associate agreement.
Local allow and block lists, proxy settings, and proxy credentials stay on the computer where either build is installed. Author does not receive those proxy credentials.
If a customer checks out or creates a portal account, Author receives the account details needed to sell and deliver the license. Those details include the name and email address the customer submits, the organization name if the customer submits one, the products purchased, and the license record for those products.
Author shows a license private key once, at the time the customer creates it. Author does not store that private key for later display.
Author uses the account and license record to provide the paid subscription, operate the portal, and answer support requests sent to [email protected]. A message sent to that address includes the contents of the message and the sender’s email address.
The Author Mirror is an optional Governance feature. It is a security gateway at https://mirror.author.io/runtime/nodejs. Related license checks use licensing.author.io. The gateway routes a download request to the official Node.js distribution source. Author maintains the gateway. Author does not operate nodejs.org or other third-party mirrors the customer configures.
If the customer enables the Author Mirror, hosted rules, or verbose license metadata, Author processes license, authentication, and policy-evaluation data. That data may include:
If the customer turns on verbose license metadata, that JWT may also include the identity claims the Software sends for auditing: idp_username, idp_machine_name, and idp_machine_id. The default is off. If the customer leaves it off, Author does not receive those three claims.
Hosted rules are rules the customer stores in the portal. The customer chooses the values in those rules. The customer may disable the Author Mirror, disable hosted rules, use a local or air-gapped install, or email [email protected] to ask Author to remove hosted rules.
The customer decides whether sending this data is acceptable under the customer’s own policies, contracts, and laws, and the customer provides any notice or permission those rules require.
Author uses personal information it receives for these purposes:
Author does not sell personal information. Author does not use personal information for cross-context behavioral advertising or other third-party advertising.
Author uses service providers to run checkout, the portal, licensing, the Author Mirror, and measurement of the Site:
Stripe, Cloudflare, and Google Firebase process the information only so Author can provide the service the customer turned on. Google Analytics processes Site-visit information as Section 9 describes. Author does not authorize these providers to sell personal information.
A download that the customer points at a third-party mirror, including nodejs.org, goes to that site under that site’s terms. Author does not operate that site and does not receive the customer’s source code from it.
Author keeps account, purchase, and license records for the subscription term and for as long as Author needs those records to provide the license, collect fees, resolve a dispute, or meet a legal duty.
A license JWT used for an Author Mirror request is short-lived. Author uses it to evaluate that request.
If the customer asks Author to remove hosted rules, Author deletes those rules from the portal. If the customer closes the account, Author deletes or de-identifies the account information it still holds, except for records Author must keep for a legal duty, a dispute, or an unpaid fee. Email [email protected] to make the request.
Email [email protected] to ask what account information Author holds, to correct it, or to delete it, as Section 6 describes.
If a law where the requester lives gives a specific right of access, correction, or deletion, Author will respond within the time that law requires. Author may need to confirm that the requester controls the account. Author will not delete a record it must keep to provide a paid license the customer has not cancelled, to collect an unpaid fee, or to meet a legal duty.
Author does not knowingly collect personal information from children under 13 through the Site or the Software. The Site and the Software are not directed at children under 13. If a parent or guardian believes a child under 13 submitted personal information, email [email protected] and Author will delete it.
Author uses the access controls and encryption its infrastructure providers supply for the portal, licensing, and the Author Mirror. No method of transmission or storage is perfectly secure.
Author is located in Texas, in the United States. Stripe, Cloudflare, and Google may process information in the United States and in other countries where those providers operate. If the customer sends directory, user, or machine identifiers to Author hosts, the customer is responsible for having a lawful basis to send that information out of the customer’s country.
The Site does not provide user accounts. If you use the security-pack request form, Author receives the information you submit, such as your name, email address, requested documents, and comments. If you email [email protected], Author receives the message and the address you send from.
The Site uses Google Analytics to understand how visitors use the Site. Google Analytics may use cookies and process browser and device details, approximate location, referring pages, and interactions with the Site. Google Analytics is separate from Google Firebase. Firebase provides portal sign-in, as Section 5 describes, and is not used on the Site for this measurement.
Hosting and network providers may process limited technical information needed to deliver and protect the Site, such as IP address, browser and device type, requested pages, referring page, and request timestamps. Infrastructure providers may use technologies needed to deliver, secure, and prevent abuse of the Site.
Author uses Site information to operate and secure the Site, understand how the Site is used, diagnose technical problems, prevent abuse, process security-pack requests, respond to email, and comply with law.
Author may disclose limited Site information to vendors that host, deliver, secure, or measure the Site, including Google for Google Analytics; when required by law or valid legal process; or when reasonably necessary to protect the rights, safety, and integrity of Author, users, or others.
The Site links to services operated by others, including GitHub, documentation, mailing lists, social-media sites, and purchasing services. Information you submit after following those links is handled under that service’s privacy policy.
Author keeps security-pack requests and email about the Site for as long as reasonably necessary to respond, provide the requested material, secure the Site, and meet a legal duty.
Author may update this policy by posting a new version. The effective date at the top will change. The End User License Agreement states when a new contract version applies to an order. A change to this policy does not, by itself, change a signed agreement.
Author Software Inc
[email protected]
5900 Balcones Dr Ste 100
Austin, Texas 78731-4298, United States