Privacy Policy

Last updated: November 4, 2026

The privacy of your data, and your code, is a big deal to us. Sourcefleet is operated by Spiralsoft. This policy explains what data we collect and why, how it is handled, and your rights over it. We never sell your data.

What we collect and why

Our guiding principle is to collect only what we need to run the Services for you.

Identity and access

When you sign up, we ask for your email address so we can send you sign-in links and other essential account messages. If you sign in with GitHub or Google instead, that provider tells us your account's unique ID and email address. We never receive your GitHub or Google password.

Repositories and connected tools

When you connect a repository or another tool, we store the connection and use short-lived, narrowly scoped credentials to let agents work with it. Agents clone code into their sandbox for the duration of a task. We keep the results you ask for, such as commits and pull requests, in the systems you connected, not on our servers.

Agent sessions

We store the instructions you give agents, their progress, and their output, so you can follow and review their work. We keep this as long as your account is active, and delete it within 60 days of you closing your account.

AI model providers

Agents send your instructions and the code relevant to their task to AI model providers, such as Anthropic, which process it under their own privacy policies.

Website visits

Our hosting provider records standard request information, such as IP address and browser details, to deliver the site and protect it from abuse.

Website analytics

We use PostHog to understand how sourcefleet.ai and our docs are used, such as which pages are visited and which buttons are clicked. Analytics events include your IP address and browser and device details. They are not linked to a name or email address, and we never use them for advertising.

Cookies

PostHog stores an anonymous identifier in a cookie and in your browser's local storage so it can recognize repeat visits. Once you sign in, we use a cookie to keep you signed in. We do not use advertising cookies.

Voluntary correspondence

When you email us, we keep that correspondence, including your email address, so we have a history to refer to if you contact us again.

When we access or disclose your information

To provide the Services. We use these subprocessors: Cloudflare (website hosting), PostHog (product analytics), Supabase (authentication and database), Google Cloud (running agents and their sandboxes), AI model providers such as Anthropic (running agents), and GitHub and Google (optional sign-in). We do not share your data with any other third parties.

To help you troubleshoot, with your permission. If we need to access your content to help with a support case, we will ask for your consent first.

To investigate or prevent abuse. Accessing an account when investigating potential abuse is a measure of last resort.

When required under applicable law. We do not respond to government requests for user data unless compelled by legal process. We will notify affected users before disclosing data unless we are legally prohibited from doing so.

Your rights with respect to your information

We apply the same data rights to all customers, wherever they are. You have the right to:

know what personal information we collect, use, and share;
access the personal information we hold about you;
have your personal information corrected;
have your personal information erased, which may mean closing your account;
restrict or object to how your personal information is processed;
receive your personal information in a portable format;
complain to the appropriate supervisory authority; and
not be treated differently for exercising any of these rights.

To exercise any of these rights, contact us at frontdoor@spiralsoft.ai.

How we secure your data

All data is encrypted in transit with TLS and encrypted at rest. Each account's data lives in its own database schemas with its own credentials, and agents run in isolated sandboxes with restricted network access and only the credentials their task needs.

Data retention

We keep your information for as long as your account is active or as needed to provide the Services. If you close your account, your content becomes inaccessible immediately and is permanently deleted within 60 days. We may keep some information where needed to meet legal obligations, resolve disputes, and enforce our agreements.

Changes and questions

We may update this policy as needed. When we make a significant change, we will refresh the date at the top of this page and notify account holders. Questions? Contact us at frontdoor@spiralsoft.ai.

Adapted from the Basecamp open-source policies / CC BY 4.0