Privacy policy

What we collect

• Your account. When you sign in with Google we receive your name, email address and profile picture, and keep a link to your Google account so you can sign in again. We do not receive your password and we ask for no other Google data. We also keep your sign-in sessions (renewed as you use the app, ending after 30 days without use), the organizations you belong to and your role in each.
• Invitations. The email address of anyone you invite, so we can send the invitation and let them in.
• What you push. The metrics, tags and free-form metadata (such as a commit or branch) your CI sends us, and the projects, organizations and dashboards you create. We never receive your source code or your binaries, only the values you choose to push. If what you push holds personal data, such as a commit author, we process it on your organization’s behalf; a data processing agreement is available on request.
• If you pay. Your organization’s billing details and the invoices we send.
• If you contact us. Your email address and what you write, so we can reply.
• Technical data. Our web host keeps request logs (IP address, browser, page requested) and we hold IP addresses briefly in memory to rate-limit sign-in attempts. Our own servers log errors, not your requests.
• Traffic analytics. Page views and page speed, measured without cookies and without identifying you.

Why we use it, and on what legal basis

• To provide the service: your account, your organizations, invitations and the metrics you push. This is necessary to perform our contract with you or your organization (GDPR Art. 6(1)(b)).
• To keep it working and secure: logs, rate limits, abuse prevention and aggregate traffic statistics. Our legitimate interest in running a reliable service (Art. 6(1)(f)).
• To run the business: a notice to our team when someone signs up, replies when you write to us, and invoices. Legitimate interest, or our legal obligations for invoicing (Art. 6(1)(c), (f)).

We do not sell your data, we do not advertise, and we do not use your metrics to train anything.

Who processes it for us

We keep this list short on purpose. Each of these acts only on our instructions, under a data processing agreement.

• Vercel (USA): hosts the website and app, keeps request logs, and provides our cookieless traffic analytics.
• Google Cloud (us-east4, USA): the server and database that hold your account and your metrics, and their backups.
• Google: sign-in.
• Resend (USA): sending email, such as an invitation.
• Discord (USA): telling our team about a new sign-up (your name, email address and plan).

Where it is stored

Your account and your metrics are stored in Google Cloud’s us-east4 region, in the United States, together with daily disk snapshots kept for 7 days. Where personal data leaves the EEA we rely on the EU-US Data Privacy Framework for providers certified under it, and on the European Commission’s Standard Contractual Clauses otherwise.

How long we keep it

• Your account and your data stay until you ask us to delete them. Runs you delete in the app are hidden but kept until then.
• Organizations whose trial has ended are paused and their data kept. We may delete an organization’s data 12 months after its trial ended without it being enabled, and will email its owners at least 30 days before.
• Backups are disk snapshots that expire 7 days after they are taken, so deleted data is gone from them within 7 days.
• Logs. Our server logs are rotated out once each service has written 30 MB. Vercel keeps request logs for the short period its plan allows.
• Invoices are kept as long as accounting law requires.

Your rights

Under the GDPR you can ask us for a copy of your data, correct it, delete it, restrict or object to how we use it, or receive it in a portable form. Email info@driftmetrics.watch from the address on your account and we will delete your account and data, or send you a copy, within 30 days. There is no self-serve deletion or export in the app yet.

If you think we have got it wrong you can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee) or to the supervisory authority where you live.

Cookies

We set cookies only once you sign in, and only those the service needs to work: one keeps you signed in, and a few short-lived ones protect the Google sign-in against forgery and remember where to send you back. Your theme and sidebar choice are kept in your browser’s local storage. There are no advertising or tracking cookies, and our traffic analytics are cookieless.

Children

Driftmetrics is for businesses and is not aimed at children.

Changes

If we change this policy we will update the date above, and tell you by email if the change matters to you.

Contact