Privacy policy

DevPulse provides developer tools: feature flags, error tracking, analytics, logs, uptime and status pages, on-call and related utilities. This policy explains what personal data we collect, why, and the choices you have.

For data your applications send to the service (for example end-user IDs in analytics events or flag contexts), you are the controller and we process it on your behalf under the Data Processing Addendum. For account, billing and website data, we are the controller.

Account data: name, email address, password hash or sign-in provider ID (GitHub, Google, Apple or your SSO provider), passkeys and 2FA settings, organization membership and roles.

Billing data: billing email and plan. Card details go directly to Stripe and never reach our servers.

Usage and security data: IP address, user agent, sign-in times and security-relevant actions, kept in session records and the organization's audit log.

Customer Data: whatever your applications send, such as events, errors, logs, flag contexts and feedback posts. You decide what goes in it. The SDKs let you mark attributes private so they're never sent.

Our website sets only the cookies needed for sign-in and security. We don't use advertising or third-party tracking cookies.

To run the service and provide support (contract).

To keep the service and your account secure, prevent abuse and meet legal obligations (legitimate interests, legal obligation).

To bill you and send service and security notices (contract).

To send product news, only if you opt in. You can unsubscribe at any time.

We don't sell personal data, and we don't use Customer Data to train machine-learning models.

We share personal data only with the subprocessors listed in the Data Processing Addendum, when the law requires it, or with a successor if our business is transferred. In a transfer, this policy continues to apply.

Account data is kept while your account is open. Deleting your account removes it immediately; backups expire within 30 days.

Customer Data is kept for your project's retention settings, within your plan's limits, and then deleted automatically.

Audit logs are kept while the organization exists and deleted with it.

Invoices are kept as long as tax law requires.

Data is encrypted in transit with TLS. Secrets, credentials and contact details are encrypted at rest with AES-256-GCM. Access is limited to people who need it to run the service. See our Security page for details.

Depending on where you live, you can access, correct, delete or export your personal data, object to or restrict processing, and withdraw consent.

You can update your profile or delete your account from account settings. For anything else, email [email protected]. If we process your data on behalf of one of our customers, we'll forward your request to them.

You can also complain to your local data protection authority.

We and our subprocessors are based in the United States. Where data protection law requires it, transfers rely on the EU Standard Contractual Clauses and the UK Addendum.

We'll post changes here and email account owners about material ones. Questions: [email protected].