Privacy Policy
Latchkey is committed to protecting the privacy and security of your data. This Privacy Policy explains how we collect, use, and safeguard your information.
Introduction
Latchkey ("we," "our," or "us") is committed to protecting the privacy and security of your data. This Privacy Policy explains how we collect, use, and safeguard your information when you use our website located at https://www.latchkey.dev/ (the "Site") and our AI-powered CI/CD monitoring services (the "Service").
By using our Service, you agree to the collection and use of information in accordance with this policy.
Information We Collect
We collect only the minimum amount of data required to provide actionable insights and optimize your pipelines.
Account & Billing Information
- Authentication: We use Clerk as our managed authentication provider, which handles sign-in via GitHub OAuth. We do not collect, view, or store your passwords.
- Billing: All payments are processed securely by our third-party payment processor, Stripe. We do not collect or store your credit card numbers, bank account details, or financial information on our servers.
Pipeline & Usage Data
- Workflow Metadata: Run IDs, job names, timestamps, failure/success statuses, and duration metrics.
- Workflow YAML Files: We read your .github/workflows YAML files to analyze job structure, caching, and dependencies. This powers AI-driven optimization recommendations and AI Scan runner configurations.
- Resource Usage: CPU and memory usage statistics used to calculate cost efficiency.
- Log Data: Build logs and error messages required to identify bottlenecks and failures.
- Runner Telemetry: When you use Latchkey Runners, we process runtime telemetry - CPU, memory, disk usage, exit codes, job durations, and per-runner metering data - to operate the runners, bill usage, surface analytics, and power self-healing.
- Self-Healing Agent Data: When self-healing engages on a failing build step, the agent processes that step's stderr, stdout, exit code, and a curated set of manifest files (e.g., package.json, requirements.txt, Cargo.toml). The agent does not have access to your source code, and its actions are bounded to a vetted allowlist.
- AI Privacy: We do not use your proprietary logs or source code to train global, multi-tenant AI models. AI insights, self-healing diagnoses, and AI Scan results are generated for your workspace only.
- Permissions Scope: For analytics, we request read-only access to GitHub Actions metadata and workflow YAML. For pull request creation, we request the minimum write scope required to open PRs you explicitly request - we never push commits or merge code on your behalf. For Latchkey Runners, your workflow YAML directs jobs to Latchkey runners via the runs-on label; no additional GitHub permissions are required.
How We Use Your Information
We use the collected data for the following purposes:
Service Delivery
To generate analytics dashboards, cost reports, and optimization insights.
Runner Operation
To provision, operate, and tear down the ephemeral Latchkey Runner instances that execute your workflow jobs, and to meter their usage for billing.
Self-Healing
To detect, diagnose, and apply bounded fixes to failing build steps on Latchkey Runners, and to display the result of each heal attempt in the dashboard's Recent Heals view.
AI Scan & Optimization
To analyze your repository structure and workflow YAML files in order to generate AI Scan runner configurations and surface optimization recommendations you can choose to apply via a Latchkey-created pull request.
Security & Reliability
To detect technical issues, security risks, or abuse of the Service.
Billing Automation
To facilitate seamless plan transitions and automated billing via Stripe.
Data Sharing and Disclosure
We do not sell, trade, or rent your personal data to third parties.
Data Security
We use industry-standard security measures to protect your data: TLS 1.2 or higher for data in transit and AES-256 for data at rest. We do not store passwords or payment information.
Latchkey runs on AWS, which is SOC 2 compliant. Customer data and Latchkey Runner instances are kept in isolated environments with strict access controls, and Latchkey Runners are ephemeral - each runner is destroyed after the job it serves completes, so no data, artifacts, or state persists between jobs.
Data Retention
We retain data in an active status for up to one year after which it is transferred to cold storage. While historical analysis remains available, retrieval from cold storage may require additional time to load. You may request full data deletion at any time following the cancellation of your plan. Archived data is typically purged after five years unless otherwise required by law.
Your Privacy Rights
Depending on your location (e.g., GDPR, CCPA), you may have rights regarding access, correction, or deletion of your personal data.
Third-Party Services
Refer to the Data Sharing and Disclosure section for information about our infrastructure providers.
Contact Us
If you have questions about this Privacy Policy, please contact us at: