Privacy Policy

What We Collect

This section lists everything DevSafe receives today: what it is, when we get it, where it goes, and how to stop it.

1. Your account (only if you create one)

• Email address, and a password if you choose one. Passwords are kept by our sign-in provider, Supabase, as a one-way hash.
• If you sign in with GitHub: the email, name, profile picture link and username that GitHub shares with us.
• What you enter in Settings: your name, organization and notification choices. If you fill in the storage box, we save your storage provider, its address and your bucket name (never your storage keys). The DevSafe program does not use these storage settings yet.
• API keys you create: a one-way hash of each key, its name, its first few characters, its permissions, and when it was last used or revoked.
• Plan and billing records: your plan, subscription status and renewal date, and the customer number Stripe gives us. We never receive your card number.
• Sign-in records: Supabase keeps standard sign-in records, such as when you last signed in.

2. Project records from the DevSafe program (only while you are signed in on that computer)

When you have run devsafe login, these commands send a record to your account so it can appear on your web dashboard:

• devsafe scan: for each project it finds, the folder name, the full folder path on your computer (for example /Users/yourname/Projects/app), the host type (GitHub, GitLab, Bitbucket or none), the remote address with any login or token removed, and whether the folder sits inside a cloud-sync folder such as iCloud or Dropbox.
• devsafe init: the same project details for the current folder, the names of the tools and services it detected (for example "Stripe"), and the names of the files it created or changed.
• devsafe preflight: the result, and for each problem found: the file path inside the project, the line number, the kind of problem (for example "AWS access key"), its severity and the suggested fix. The secret itself is never sent.
• devsafe backup, including scheduled backups and backups started from the local dashboard: the project's full folder path, the size of the encrypted backup file, the ID of the latest commit (a short code that names it, not its contents), and that the backup finished.

These records are stored in our database at Supabase. You can use DevSafe without signing in, and then none of them are sent. To stop them, run devsafe logout. Signing out does not delete records already sent; to delete them, ask us (see Your Rights).

3. Plan checks and payments from the DevSafe program

• When you sign in, run devsafe plan, or your sign-in renews, the program asks our server which plan you have. It sends your sign-in token for this.
• devsafe upgrade and devsafe billing ask our server to open a Stripe checkout or billing page for your account.

4. The signup check (only when you create an account)

To stop automated fake signups, our signup page measures how the form is used: how many times Backspace or Delete is pressed in each field, how long each click is held and how far the pointer moves during it, and whether pasted text came right after a copy or a tab switch. It never records what you type. Our server also receives your email address, how long the form took, whether your browser reports that software is controlling it, and your IP address. It turns these into a score and a verdict. We store the email domain (the part after the @, not your full address), the score, the verdict and its main reasons, those yes-or-no checks, how long the form took, and a one-way hash of your IP address. For email signups, if the check fails or cannot be reached, the signup is blocked. After signup we also store which page sent you to us (if your browser shares it), whether you confirmed your email, and a risk level (green, yellow or red) on your profile.

5. Email

• Sign-in emails (confirm your address, login links, password resets) and account and billing emails are sent through our email provider, Resend.
• Our email list. When you create an account, we send you a welcome email and add your address to our DevSafe email list. If you join the newsletter on our website, we keep your email, your name if you give it, the topics you picked and the page you signed up on. You can unsubscribe at any time on our unsubscribe page. We keep a record that you unsubscribed so we do not email you again.

6. Messages and forms you send us

• Contact form: your name, email, topic, subject, message and the page you sent it from. It is emailed to our team inbox through Resend. It is not saved in our database.
• Waitlists, "notify me" forms, the risk checklist and the checklist book: the email, name and answers you enter (for the risk checklist, also your role, score and gaps). The risk checklist can email your results to you.
• Team and contact requests inside the web app: the type of request, your name, your team size and your message.

7. Ask Voss on our blog

Some blog posts have an "Ask Voss" box. The page answers common questions itself. Other questions are sent to our server, which asks Anthropic's Claude AI to write an answer, together with the text of the post. We store each question exactly as typed and its answer, so repeat questions are answered faster, and a one-way hash of your IP address, to limit how many questions can be asked. Please do not type personal information into it.

8. Visiting our website

• Cloudflare hosts devsafe.com. Like any web host, it receives your IP address, browser details and the pages you request, and uses them to deliver the site and block attacks.
• Our site settings also allow Cloudflare Web Analytics, which Cloudflare can add to our pages to count visits without cookies.
• Our pages load fonts from Google Fonts and our sign-in library from jsDelivr. Your browser connects to them directly, so they receive your IP address and browser details.
• Our code contains no advertising networks, tracking pixels or third-party analytics tags.

9. The DevSafe program's update check

Once a day, the DevSafe program asks GitHub whether a newer version exists. This request goes to GitHub, not to us, and carries only what every web request carries (your IP address and a generic program name). Turn it off with devsafe config set check_for_updates false. DevSafe downloads also come from GitHub.

10. Server logs

Supabase keeps standard request logs for our database and server functions, including your IP address and the address of each request. For backup records, that address contains the project's folder path. Some of our own log lines include the email address of a new GitHub signup, or of a Stripe customer when a payment record is incomplete.

No analytics or crash reports from the program. The DevSafe program has no usage analytics and sends no crash reports. Apart from the daily update check, it only contacts us while you are signed in, for the records and plan checks above. devsafe support builds a report on your screen; we only see it if you send it to us.

What We Don't Collect

This list matters more than the one above.

• Your source code, your file contents, or what your commits contain (we do receive file paths, line numbers and commit IDs, as described above)
• Your encryption key or your recovery code
• Your backups, in any form. They go from your computer straight to your own storage and never pass through DevSafe.
• Your cloud storage credentials (those stay on your machine)
• The secret values that DevSafe's scans find
• What you type into our signup form (only the counts and timings described above)
• Your browsing on other websites, or your precise location

How We Use Your Data

• Account and plan records: to sign you in, run your plan, and take payments.
• Project records: to show your projects, backups and scan results on your web dashboard.
• Signup check: to block automated fake accounts.
• Email: sign-in emails, account and billing notices, support replies, and DevSafe product email you can unsubscribe from. No third-party lists.
• Messages and forms: to answer you and send what you asked for.
• Ask Voss questions: to answer them, and to answer repeat questions faster.
• Logs: to keep the service running and find problems.

We do not sell your data. We do not share it with advertisers. We do not run ads. Period.

Legal basis (GDPR): We process your data under legitimate interest (running the service, keeping it secure and fixing bugs) and contract performance (delivering the product you signed up for). We do not process data beyond what is necessary for these purposes.

California residents (CCPA): We do not sell personal information. We do not share personal information for cross-context behavioral advertising. You have the right to know what we collect, request deletion, and opt out of any future sale. We will never discriminate against you for exercising these rights.

Your Encryption

Your backups are stored in your own cloud bucket (Cloudflare R2, AWS S3, Backblaze B2, or any S3-compatible provider). DevSafe pushes encrypted files to your storage. We never have credentials to your bucket.

When you set up key recovery, DevSafe also saves a recovery copy of your key in your own storage, locked with your recovery code (or a passphrase you choose). We never receive that copy or the code.

If you lose your encryption key and your recovery code, your backups are gone. We cannot recover them for you. This is the tradeoff of real encryption, and we think it's the right one.

Third Parties

We do not sell, rent, or trade your personal information. We do not use third-party advertising networks or tracking pixels.

These services handle data for us (our sub-processors):

• Supabase: our database, sign-in and server functions. Holds the account, project, signup, email list and form records above, and our server logs.
• Cloudflare: hosts our website and protects it from attacks. Sees visitors' IP addresses and requests, and may count visits with its cookie-free Web Analytics.
• Stripe: payments. Receives your email address, your DevSafe user ID and your plan choice from us, and the card details you type into Stripe's own checkout page. We never see your card number.
• Resend: sends our email. Receives your email address and the content of each email, including contact form messages it delivers to our inbox.
• Google: Google Fonts (your browser fetches fonts from Google, so Google may collect your IP address and browser details; see Google's Privacy Policy) and Google Workspace, which hosts our team inbox where contact form messages arrive.
• Anthropic: writes Ask Voss answers. Receives the question and the text of the blog post.
• jsDelivr: delivers the sign-in library our pages use. Your browser connects to it, so it sees your IP address and browser details.
• GitHub: GitHub sign-in (if you choose it), DevSafe downloads, and the program's daily update check.

A current list of sub-processors is published on our Trust Center.

Cookies

Our own code sets no cookies. Our pages keep a few things in your browser's storage, which stays on your device:

• Your sign-in session, if you sign in (kept by our sign-in library from Supabase).
• Your theme, menu state, audience choice, plan choice and notification choices.
• On the signup page: a random session ID for the signup check, and the plan you picked. These are cleared when you close the tab.
• On the risk checklist: your name, email and answers, until you close the tab.

Cloudflare, our host, may set its own short-lived security cookie to tell people from bots. No tracking cookies. No advertising cookies.

Your Rights

You have the right to:

• Access the personal data we hold about you
• Correct any inaccurate information
• Delete your account and its data. Self-serve deletion is not available yet; ask us and we will do it.
• Export your data in a portable format
• Unsubscribe from our email at any time
• Stop the DevSafe program from sending project records, by running devsafe logout

These rights apply regardless of where you live. You do not need to cite a regulation. Just ask.

Data Retention

We have not yet set fixed time limits for most of the data above. This is what happens today:

• Account, project, scan, backup, API key and plan records are kept while your account exists. When your account is deleted, they are deleted with it.
• Signup check records have no set end date. When an account is deleted, the link between the account and these records is removed, but the records stay.
• Ask Voss questions and answers have no set end date.
• Email list entries stay until we remove them. If you unsubscribe, we keep that record so we do not email you again.
• Waitlist, checklist and form entries have no set end date. Contact form messages stay in our team inbox.
• Server logs are kept for as long as Supabase keeps them under our plan.
• Stripe keeps payment records under its own rules.

Your encrypted backups live in your own storage. We do not control them and cannot delete them. When you remove DevSafe, your backups stay in your bucket until you decide what to do with them.

Children

DevSafe is a developer tool. We do not knowingly collect data from anyone under 16. If you believe a child has provided us with personal information, contact us and we will delete it.

Data Breach Notification

If we discover a breach affecting your personal data, we will notify you by email within 72 hours of becoming aware of it (as required by GDPR Article 33). We will tell you what happened, what data was affected, and what we are doing about it.

Your code and backups never reach our systems, so a breach of our systems cannot expose your source code or repository contents. It could expose the account and project records described above, such as project names and folder paths.

Governing Law

This Privacy Policy is governed by the laws of the State of Wyoming, United States. If you are located in the European Economic Area, you also retain all rights under the GDPR.

Changes to This Policy

If we change this policy, we will update the effective date at the top and notify you by email if the changes are significant. We will not quietly reduce your rights.

Contact

Questions about this policy or how we handle your data? Reach out.