Privacy Policy
Denly · Operated by Control Plane · Effective: August 3, 2026
This Privacy Policy explains what Denly, operated by
Control Plane (the "Service", at
https://denly.dev) collects, what it deliberately does not, and how
your information is handled.
The data boundary – local checkout, selected uploads. Denly
agents run on
your own machine; we do not host its working repository
checkout. Your AI provider credentials stay on that machine. Your code host and
AI provider receive the data the work requires under your agreements with them.
Selected uploads to Denly can contain source code or secrets: repository READMEs,
project documents, plan snapshots, attachments, conversations, recorded agent output
and no-Git review diffs. Recording defaults to
Full, including command
output and file contents; workspace or project policy can select Text or Off.
End-to-end encryption is optional. It encrypts supported content on
your device under a passphrase we do not hold. Without it, uploaded content is
readable to the service. Metadata such as status, timing, cost and pull-request URLs
remains readable either way. Skills remain plaintext for server-side validation.
See the
security documentation for
coverage and known limitations; encryption does not remove the uploaded data.
1. Information We Collect
- Account & organization – your email and identity from your
sign-in provider; org and membership details.
- Project metadata – project identifiers, repository names, and
settings you configure.
- Task & agent activity – task titles/descriptions you enter,
plans, conversations, recorded agent output (including file contents at Full),
no-Git review diffs, run status, cost/token counts, and pull-request URLs.
Optional end-to-end encryption protects supported free-text parts; see the
security documentation for coverage and known failure paths. Status, cost
and URLs remain visible so the dashboard works.
- Documents & attachments – docs and skills stored in the
dashboard, repository README uploads, tracked plan snapshots and attachments.
These can contain source code or secrets.
- Audit & operational logs – security-relevant actions (e.g. token
and project changes) and basic request logs for reliability and abuse prevention.
- Optional first-party site measurement – if you allow it,
public page views, Start free clicks, and new signups, with the page path,
a random browser journey ID, and any campaign source, medium, and name in
the link you followed. These events go into our operational logs without
your email or full referring URL. After consent, we may classify the referring
domain as search or referral traffic. With the expanded measurement choice,
a new signup also links the journey to your account, first authenticated runner
connection and reviewed task completion metadata for up to 90 days. We do not
copy task content into the measurement record.
- Subscription status – plan and status from our payment processor
(see below). We do not receive or store your card details.
2. What We Do Not Collect
- A hosted copy of your complete working repository checkout. Selected
repository content can be uploaded as described above.
- Your AI provider's API key or subscription credentials (Anthropic / Claude or any other agent runtime you use).
- Your payment card details (handled entirely by our payment processor).
3. How We Use Information
To provide and operate the Service, coordinate agent work, show your dashboard, enforce
plan limits, understand how visitors reach signup, secure the Service and prevent abuse, communicate with you about your account,
and comply with law.
4. Service Providers (Sub-processors)
- Supabase – Authentication (Supabase Auth) and the control database (Postgres, PostgREST, Realtime).
- Google Cloud Platform – Hosting (Cloud Run), structured request/query logs (Cloud Logging), the cost-baseline dashboard (Cloud Monitoring), secrets (Secret Manager), and release artifacts (Cloud Storage).
- GitHub – Code host, via a scoped GitHub App installation you authorize. Used to open pull requests, read repository metadata, and (if you use the optional skill library) sync community skills.
- GitLab (optional) – Optional second code host, for organizations that connect GitLab instead of (or alongside) GitHub. Same nature as the GitHub relationship above.
- Polar – Merchant of record. Handles checkout, payment, tax, and provides subscription status back to us.
- Brevo – Transactional email: invites, digests, and notification delivery.
- Slack (optional) – Optional per-workspace integration: outbound activity notifications to a channel you choose, and inbound webhook events if you wire one up.
- Sentry (optional) – Optional error-monitoring, for diagnostics. Off by default on this deployment – active only if the operator sets SENTRY_DSN.
Full detail on each one – what it receives and where it operates – is on our
Subprocessors page. If your organization needs a
Data Processing Addendum, see our DPA.
Not a subprocessor: Anthropic (Claude), and any other AI provider your runtime uses. Your agent runs locally on your own machine, authenticated with your own API key or subscription. It talks to your AI provider directly – we never see the request, the response, or your credentials. That provider is your processor for that traffic, under whatever agreement you have with them, not ours.
5. Cookies & Local Storage
The dashboard uses local storage for your session token and interface preferences.
If you allow optional site measurement, the public site also keeps a random journey ID
and any campaign labels in local storage, valid for seven days, so a Start free click and
a new signup in the same browser can be counted together. Choose Allow measurement or
No thanks on the public site; you can change the choice using its Site measurement
footer link. Declining stops browser measurement immediately; any pending account
withdrawal is applied on your next sign-in in that browser. You can turn off and
delete the account link immediately in Account settings, from any signed-in browser.
Earlier site-only permission does not authorize account-linked measurement.
It does not use third-party advertising or tracking cookies.
6. Data Retention
We retain your information while your account is active and as needed to provide the
Service and meet legal obligations. Disconnecting a project or deleting your organization
removes the associated metadata from the control database.
Beyond that, these categories are deleted automatically on a schedule:
- Audit trail: 365 days. A workspace's security record – token mints, machine changes, member changes, task commands. A year covers an annual review and any realistic after-the-fact investigation; beyond that it is a log of who did what, kept for no stated purpose.
- Task activity threads (completed work): 365 days. The agent conversation, plans and review notes on a task. This is the most sensitive content the control DB holds – it can quote source code – so it should not outlive the work indefinitely. Applies only to tasks in a terminal stage; an in-flight task keeps its whole thread however long it takes.
- Live agent output (opt-in recordings): 14 days. When you turn on live agent output, Denly keeps what the agent said, reasoned, ran and read while it worked. This is the most detailed record Denly holds: it quotes your source code, your file contents and your shell commands word for word. You want it while you are watching a run, and rarely after. So it lives a fraction of the ordinary task thread's life, and a second clock removes it 30 days after it was written even if the task is still open. Recording stays off until a project turns it on.
- Notification delivery ledger: 90 days. A record of which alert was emailed to whom, kept so one blocked task cannot send the same email twice. That purpose expires with the episode, so 90 days is already generous.
Optional account-linked measurement expires 90 days after signup and is removed
by the periodic retention job. Withdrawal deletes that link immediately. A minimal
account opt-out receipt remains until the same 90-day deadline to prevent a delayed
request from recreating it; account deletion also removes this receipt. Anonymous
public-page events remain subject to the operational log retention period; account
identifiers are never added to those event lines.
Deleting your account erases your personal data immediately rather than waiting for
these periods – see §7.
7. Your Rights
Depending on your location, you may have rights to access, correct, export, or delete
your personal information. You can manage or delete much of it directly in the dashboard, or
contact us to exercise these rights.
8. Security
We use measures such as scoped runner tokens, per-organization isolation, and encrypted
transport. Optionally, end-to-end encryption (above) keeps your task content unreadable to us
even at rest. No method is perfectly secure, but the data boundary above minimizes what is
ever at risk on our side.
9. International Transfers & Children
Your information may be processed in countries other than your own. The Service is not
directed to children under 16, and we do not knowingly collect their information.
10. Changes
We may update this Policy; material changes will be posted here with a new effective
date.
11. Contact
Privacy questions: legal@denly.dev.