Privacy policy

What we collect

• Your account. When you sign in with Google we receive your name, email address and profile picture. We do not receive your password and we ask for no other Google data.
• What you push. The metrics, tags and version labels your CI sends us, and the projects and organizations you create. We never receive your source code or your binaries — only the numbers you choose to push.
• If you contact us. The email address and any notes you submit through the form on our home page, so we can reply.
• Ordinary server logs. IP address, browser and request details, kept to keep the service running and secure.

Why we may use it, and on what legal basis

• To provide the service — your account, your organizations and the metrics you push. This is necessary to perform our contract with you (GDPR Art. 6(1)(b)).
• To keep it working and secure — logs, abuse prevention, aggregate usage statistics. Our legitimate interest in running a reliable service (Art. 6(1)(f)).
• To reply to you when you write to us, or to tell an invited colleague that they have been invited. Legitimate interest, or your consent where you gave it (Art. 6(1)(a)).

We do not sell your data, we do not advertise, and we do not use your metrics to train anything.

Who processes it for us

We keep this list short on purpose. Each of these acts only on our instructions, under a data processing agreement.

• Vercel — hosting and basic, cookieless traffic analytics.
• Neon — the database holding your account and your metrics.
• Google — sign-in, if you choose to sign in.
• Resend — sending email, such as an invitation.
• Discord — notifying us when someone fills in the contact form.

Some of these are established in the United States. Where personal data leaves the EEA it is transferred under the European Commission’s Standard Contractual Clauses.

How long we keep it

Your account and the metrics you push stay until you delete them or ask us to. Server logs are kept only as long as they are useful for security and debugging. Write to us and we will delete your account and everything in it.

Your rights

Under the GDPR you can ask us for a copy of your data, correct it, delete it, restrict or object to how we use it, or receive it in a portable form. Where we rely on consent you can withdraw it at any time. Email info@driftmetrics.watch and we will answer within one month.

If you think we have got it wrong you can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee) or to the supervisory authority where you live.

Cookies

We set one cookie, and only once you sign in: it keeps you signed in. There are no advertising or tracking cookies. Our traffic analytics are cookieless and do not identify you.

Children

Driftmetrics is for developers at work and is not aimed at children.

Changes

If we change this policy we will update the date above, and tell you by email if the change matters to you.

Contact