Privacy Policy

What we collect

We collect information in a few narrow categories:

• Account information. The email address you register with and basic authentication data needed to sign you in, keep your session, and (if you enable it) verify a second factor.
• Organization data. The organizations, members, and invitations you create, and the repositories, registries, and environments you connect for review.
• Integration credentials. Tokens you provide to connect a registry or code host. These are stored encrypted and used only to reach the integrated service on your behalf.
• Release metadata. Package names, versions, file listings, diffs, checksums, and the review findings we compute for the releases you submit.
• Operational data. Logs and events generated as the service runs, kept for reliability, abuse prevention, and debugging. We redact secrets and never log raw credentials, headers, or package contents.
• Product usage. Aggregate counts of a few milestones — an account created, an integration connected, a review completed, a release decision recorded — so we can tell whether the product works. These are recorded on our own servers and carry no personal data at all: no email address, no user identifier, no organization name, no package names or repositories. An internal organization ID is the only identifier attached, so we can see how many organizations are active without identifying a person. The one exception is our public diff tool, which is anonymous and records the public registry package being compared, with no account attached. There is no third-party analytics service and no tracking script in the app.

How we use it

We use the information above to:

• operate your account, organizations, and sessions;
• review the releases you submit and show you the resulting report;
• connect to the registries and code hosts you authorize, and report decisions back;
• keep the service secure, prevent abuse, and diagnose problems;
• measure, in aggregate, how the product is used so we can improve it;
• send you transactional messages such as verification and review notifications.

We do not sell your personal information, and we do not use your release contents to train models.

Credentials & package contents

Integration tokens are stored encrypted and decrypted only at the moment Drydock needs to talk to the integrated service. Drydock never publishes on your behalf — you complete a publish with your own credentials — and a release is downloaded into a short-lived, isolated sandbox where its contents are inspected as untrusted evidence and never executed.

How we share it

We share information only as needed to run the service: with infrastructure providers that host and operate Drydock, with the registries and code hosts you explicitly connect (to fetch the artifacts you ask us to review and report decisions back), and where we are legally required to. We do not sell or rent your information to third parties.

Data retention

We keep account and organization data for as long as your account is active. Review reports and release metadata are retained so you can refer back to past decisions. Operational logs are kept for a limited period and then deleted. When you delete your account or an organization, we delete or anonymize the associated data, except where we must retain it to meet a legal obligation.

Security

We protect data in transit and at rest, encrypt the credentials you entrust to us, scope every request to your organization, and limit access to production systems. No system is perfectly secure, but the service is built to fail closed and to keep credentials out of the components that inspect untrusted package contents.

Cookies

We use first-party cookies that are strictly necessary to sign you in and keep your session. We do not use advertising cookies or third-party tracking cookies.

Your choices & rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal information, and to object to or restrict certain processing. You can manage much of your data from your account settings, or contact us and we will help. We will not discriminate against you for exercising these rights.

International transfers

Drydock runs on globally distributed infrastructure, so your information may be processed in countries other than your own. Where required, we rely on appropriate safeguards for those transfers.

Children

Drydock is a tool for software maintainers and is not directed to children. We do not knowingly collect personal information from anyone under 16.

Changes to this policy

We may update this policy as the service evolves. When we make material changes, we will update the effective date above and, where appropriate, notify you. Continued use of Drydock after a change means you accept the updated policy.