--- title: "Privacy Policy | Openshard" description: "Privacy Policy for Openshard, Inc." url: https://openshard.dev/privacy-policy markdown: https://openshard.dev/privacy-policy.md updated: 2026-10-24 --- # Privacy Policy Last updated: Oct 24, 2026 ## 1. Who we are This policy explains how Openshard, Inc. ("Openshard", "we", "us") collects and uses personal data when you visit our website, use the hosted dashboard at app.openshard.dev and related services, use our open-source command-line tool, book a call or contact us. Openshard, Inc. is a Delaware corporation whose mailing address is 2810 N Church St #90898, Wilmington, DE 19802, United States. We are run from London, United Kingdom. For account, website and marketing data, we are the controller. For personal data inside Receipts that your organisation syncs to us, your organisation is the controller and we process it on its behalf under our Data Processing Addendum. ## 2. The short version - On the Free plan, Receipts are made and kept on your machine. We never receive them. - When you turn on sync, we receive facts about work, not your code. We reject data containing diffs, prompts, transcripts, command output, environment variables, secrets or absolute file paths. - We do not sell personal data, and we do not use your data to train AI models. - The command-line tool's telemetry is anonymous, and you can turn it off with one setting. ## 3. What we collect ### Account information Your name, email address, job title, organisation and role, and records of sign-in. Sign-in is handled by our authentication provider, WorkOS. ### Receipts you sync (Pro, Team and Enterprise) Repository and branch names, commit identifiers, pull request numbers and links, relative file names and line counts, agent and model names, token counts and costs, which checks ran and their results, timestamps, and who ran or approved the work, such as their name, email address and job title. ### GitHub App If you install the Openshard GitHub App, we receive the installation details, repository names and pull request and commit information, including commit author names and usernames, needed to show Receipts on pull requests and run the merge gate. ### Billing Your plan, billing contact, billing address and tax details. Payments are processed by Stripe. We do not see or store your full card number. ### Command-line telemetry After showing a notice, the open-source tool sends basic product telemetry: counts, version numbers, timings, operating system type and a random installation ID. By design it cannot contain code, file paths, repository names, email addresses or other free text. It is off in CI, and you can turn it off at any time by setting OPENSHARD_TELEMETRY=off or DO_NOT_TRACK=1, or with telemetry: enabled: false in your project's Openshard config. ### Website, email and calls What you send us through email, our contact form or our newsletter sign-up, and the details you give when booking a demo through Cal.com. When you visit our website or dashboard, our servers log technical data such as your IP address, browser type and the pages requested, for security and to keep the service running. ## 4. How we use it, and why - To provide the Services you signed up for, including syncing and showing Receipts, running the merge gate and handling billing (to perform our contract with you). - To keep the Services secure, prevent abuse and fix problems (our legitimate interests). - To understand how the product is used and improve it, using telemetry and aggregated usage (our legitimate interests; you can opt out of telemetry). - To reply to you, run demo calls and send product updates or newsletters you asked for (contract, legitimate interests or your consent, which you can withdraw at any time). - To meet legal obligations, such as tax and accounting rules. ## 5. AI features If your organisation uses Ask Openshard in Insights, the question and the relevant Receipt facts are sent to an AI model provider, currently Anthropic, to produce an answer. They are not used to train models. Receipts never include your source code, so it is never sent. ## 6. Who we share it with We share personal data only with service providers that help us run Openshard, under contracts that require them to protect it, and only as much as they need: - WorkOS: sign-in and authentication - Stripe: payments and billing - Railway: application hosting and databases - GitHub: the Openshard GitHub App and merge gate - Anthropic: AI answers in Insights, only when used - Cal.com: demo call booking - Cloudflare: DNS and email routing - Google: email We may also share data if the law requires it, to protect our rights or users' safety, or as part of a merger or sale of our business, in which case this policy will continue to apply. We do not sell personal data or share it for advertising. ## 7. International transfers Some of our providers are based in, or process data in, the United States. Where personal data leaves the UK or the European Economic Area, we use recognised safeguards, such as the UK International Data Transfer Addendum and the EU Standard Contractual Clauses. ## 8. How long we keep it - Account data: while your account is open, and deleted within 30 days of closing it. - Synced Receipts: for as long as your organisation keeps them or its plan allows, and deleted within 30 days of the organisation being deleted. - Backups: deleted data can remain in encrypted backups for up to 90 days. - Billing records: kept for as long as tax and accounting law requires, usually seven years. - Telemetry: kept in aggregated form, with raw events deleted after 12 months. ## 9. How we protect it Data is encrypted in transit and at rest. Access is limited to the people who need it. Receipts are signed so that changes can be detected. No system is perfectly secure, so if a breach affects your personal data, we will tell you and the regulator as the law requires. ## 10. Your rights Under UK and EU data protection law, you can ask to access, correct, delete or export your personal data, object to or restrict how we use it, and withdraw consent at any time. To use these rights, email [michael@openshard.dev](mailto:michael@openshard.dev). We will reply within one month. If your data is inside an organisation's Receipts, we may pass your request to that organisation, as it controls that data. You can also complain to the Information Commissioner's Office at ico.org.uk, or to your local data protection authority. We would appreciate the chance to help first. If you live in California or another US state with privacy laws, you have similar rights to know, delete and correct your data. We do not sell or share personal data as those laws define it. ## 11. Children Openshard is not intended for anyone under 18, and we do not knowingly collect their data. ## 12. Changes to this policy We will update this page when our practices change and change the date at the top. If a change is significant, we will tell account holders by email or in the dashboard. ## 13. Contact Questions or requests about privacy? Email [michael@openshard.dev](mailto:michael@openshard.dev). --- Openshard, Inc. · Delaware corporation · michael@openshard.dev Install: `pipx install openshard && openshard setup` · Dashboard: https://app.openshard.dev · Source: https://github.com/openshard/openshard Agent index: https://openshard.dev/llms.txt · Whole site in one file: https://openshard.dev/llms-full.txt