Privacy Policy

Denly · Operated by Control Plane · Effective: August 3, 2026

This Privacy Policy explains what Denly, operated by Control Plane (the "Service", at https://denly.dev) collects, what it deliberately does not, and how your information is handled.

The data boundary – what never reaches us. Denly agents run on your own machine. Your source code and your AI provider credentials (API key or subscription – Anthropic / Claude or whichever agent runtime you use) stay on that machine – they are never transmitted to, processed by, or stored on our servers. Your code goes to your code host (e.g. GitHub) directly from your machine. We only ever see whether a runner authenticates with a subscription or an API key – never the key material itself. When you enable end-to-end encryption, the free-text content that could quote your code – task descriptions, plans, and agent conversations – is encrypted on your device under a passphrase only you hold, before it is uploaded. We store only the resulting ciphertext and cannot read it; we hold no copy of your passphrase or key. What we still see in that mode is non-content metadata: status, timing, cost, and pull-request URLs.

1. Information We Collect

Account & organization – your email and identity from your sign-in provider; org and membership details.
Project metadata – project identifiers, repository names, and settings you configure.
Task & agent activity – task titles/descriptions you enter, plan summaries the agent writes, run status, cost/token counts, and pull-request URLs. With end-to-end encryption enabled, the free-text parts (descriptions, plans, conversations) reach us only as ciphertext we cannot read; status, cost, and URLs remain visible so the dashboard works.
Documents – any docs or skills you choose to store in the dashboard.
Audit & operational logs – security-relevant actions (e.g. token and project changes) and basic request logs for reliability and abuse prevention.
Subscription status – plan and status from our payment processor (see below). We do not receive or store your card details.

2. What We Do Not Collect

Your source code / repository contents.
Your AI provider's API key or subscription credentials (Anthropic / Claude or any other agent runtime you use).
Your payment card details (handled entirely by our payment processor).

3. How We Use Information

To provide and operate the Service, coordinate agent work, show your dashboard, enforce plan limits, secure the Service and prevent abuse, communicate with you about your account, and comply with law.

4. Service Providers (Sub-processors)

Supabase – Authentication (Supabase Auth) and the control database (Postgres, PostgREST, Realtime).
Google Cloud Platform – Hosting (Cloud Run), structured request/query logs (Cloud Logging), the cost-baseline dashboard (Cloud Monitoring), secrets (Secret Manager), and release artifacts (Cloud Storage).
GitHub – Code host, via a scoped GitHub App installation you authorize. Used to open pull requests, read repository metadata, and (if you use the optional skill library) sync community skills.
GitLab (optional) – Optional second code host, for organizations that connect GitLab instead of (or alongside) GitHub. Same nature as the GitHub relationship above.
Polar – Merchant of record. Handles checkout, payment, tax, and provides subscription status back to us.
Brevo – Transactional email: invites, digests, and notification delivery.
Slack (optional) – Optional per-workspace integration: outbound activity notifications to a channel you choose, and inbound webhook events if you wire one up.
Sentry (optional) – Optional error-monitoring, for diagnostics. Off by default on this deployment – active only if the operator sets SENTRY_DSN.

Full detail on each one – what it receives and where it operates – is on our Subprocessors page. If your organization needs a Data Processing Addendum, see our DPA.

Not a subprocessor: Anthropic (Claude), and any other AI provider your runtime uses. Your agent runs locally on your own machine, authenticated with your own API key or subscription. It talks to your AI provider directly – we never see the request, the response, or your credentials. That provider is your processor for that traffic, under whatever agreement you have with them, not ours.

5. Cookies & Local Storage

The dashboard uses local storage for your session token and interface preferences. It does not use third-party advertising or tracking cookies.

6. Data Retention

We retain your information while your account is active and as needed to provide the Service and meet legal obligations. Disconnecting a project or deleting your organization removes the associated metadata from the control database.

Beyond that, these categories are deleted automatically on a schedule:

Audit trail: 365 days. A workspace's security record – token mints, machine changes, member changes, task commands. A year covers an annual review and any realistic after-the-fact investigation; beyond that it is a log of who did what, kept for no stated purpose.
Task activity threads (completed work): 365 days. The agent conversation, plans and review notes on a task. This is the most sensitive content the control DB holds – it can quote source code – so it should not outlive the work indefinitely. Applies only to tasks in a terminal stage; an in-flight task keeps its whole thread however long it takes.
Live agent output (opt-in recordings): 14 days. When you turn on live agent output, Denly keeps what the agent said, reasoned, ran and read while it worked. This is the most detailed record Denly holds: it quotes your source code, your file contents and your shell commands word for word. You want it while you are watching a run, and rarely after. So it lives a fraction of the ordinary task thread's life, and a second clock removes it 30 days after it was written even if the task is still open. Recording stays off until a project turns it on.
Notification delivery ledger: 90 days. A record of which alert was emailed to whom, kept so one blocked task cannot send the same email twice. That purpose expires with the episode, so 90 days is already generous.

Deleting your account erases your personal data immediately rather than waiting for these periods – see §7.

7. Your Rights

Depending on your location, you may have rights to access, correct, export, or delete your personal information. You can manage or delete much of it directly in the dashboard, or contact us to exercise these rights.

8. Security

We use measures such as scoped runner tokens, per-organization isolation, and encrypted transport. Optionally, end-to-end encryption (above) keeps your task content unreadable to us even at rest. No method is perfectly secure, but the data boundary above minimizes what is ever at risk on our side.

9. International Transfers & Children

Your information may be processed in countries other than your own. The Service is not directed to children under 16, and we do not knowingly collect their information.

10. Changes

We may update this Policy; material changes will be posted here with a new effective date.

11. Contact

Privacy questions: legal@denly.dev.