Privacy policy

SigDek is operated by Tekton Software LLC, a Nevada company ("we"). This policy covers sigdek.com, the SigDek dashboard, and the SigDek recorder when connected to a team. Questions go to privacy@sigdek.com.

Our role

Teams use SigDek to keep records of AI coding agent activity on their own machines. For those records, the team's organization is the controller and we process them on its behalf, under our terms. For account and billing information about the people who sign in, we are the controller.

What we collect

• Account information: name, email address, the ID of the GitHub or Google account you sign in with, and the IP address and browser user agent stored with each sign-in session.
• Agent activity records, once a machine is connected: the person's email address, machine name and operating system, the agent and its version where the agent reports one, the agent's model and permission mode, session, repository, and for each action its kind, the command, file path or URL with secrets removed, the result and timing. For each prompt, its length and a SHA-256 hash; for each action, a SHA-256 hash of the full tool input, or of the stored form when a secret was removed. Never prompt text, file contents or command output.
• Email: we send account emails (sign-in links and team invitations) and notices about your team (reports, machines, rule changes, trial and billing). You can turn the notices off for each team in the dashboard's settings. We keep a log of each email sent (the address, its kind, when, and whether our email provider accepted it) for 90 days, never its content.
• Billing information: handled by Stripe. We receive the billing contact, plan and payment status, and any refund we make, never card numbers. To show them on the Billing page, the dashboard reads the card's brand and last four digits and the team's invoices from Stripe each time the page asks; we don't store them.
• Service logs: IP addresses and request details kept briefly by Cloudflare to run and protect the service. To limit requests, our database also counts them by IP address, and sign-in link requests by email address; each count is deleted by a daily job once a day has passed since its last use.

The website uses no advertising or analytics trackers and sets no cookies. The dashboard sets only the cookies needed to keep you signed in. Its checkout page, where a team owner or admin pays for a plan, also loads Stripe's script from js.stripe.com, which shows Stripe's payment form inside Stripe's own frames. That script sets two cookies of Stripe's on the dashboard's address, __stripe_mid and __stripe_sid. Card details you type into the payment form go only to Stripe. Stripe sends us the billing details that come with the payment, such as the name, email address and billing address; we don't store them. Stripe's form, and the services it loads inside its frames, can set their own cookies on their own addresses and receive what they need from your browser: hCaptcha, which checks that a visitor isn't a bot; Google Pay; Apple Pay, for which Stripe's form can load Apple's Apple Pay script and check with Apple whether Apple Pay is available, as soon as the form loads; Google Maps, which suggests addresses as you type one, so the address you type is sent to Google; and Link, Stripe's checkout service, which checks whether you're signed in to it and is used if you choose it. Each handles this under its own policy: Stripe's privacy policy and cookie policy, hCaptcha's, Google's, Apple's and Link's. Stripe collects identifying information about the devices that connect to its services, and uses it to operate and improve the services it provides to us, including for fraud detection.

Why we use it

To provide the service your team signed up for (recording, the dashboard, reports), to bill for it, to keep it secure, to answer support requests, and to meet legal obligations. We don't sell personal information, use it for advertising, or use your team's records to train AI models.

Who else handles it

Cloudflare (hosting, storage and sending email), Neon (database, in the United States), Stripe (payments), Google Workspace (email sent to us), and GitHub or Google if you sign in with them. They process data only to provide their services to us. We disclose information if the law requires it, and would tell the affected team unless prohibited.

How long we keep it

Agent activity records: 13 months, along with the original uploads and notes of breaks in a machine's record chain. Generated reports and account information: while the team exists. A report's CSV includes every record for its period, and its PDF and HTML include names, counts and example commands, so those copies are kept as long as the report. Our database provider keeps a point-in-time history for recovery; deleted data leaves that history within 30 days. After a team is deleted, its data is removed within 30 days. Stripe keeps the billing and tax records for the payments it took.

Your choices

If your team uses SigDek, ask its owner first about records of your activity; they control them. You can ask us to access, correct or delete your account information at privacy@sigdek.com, and we'll respond within 30 days. Depending on where you live, you may have further rights under laws such as the GDPR or California's CCPA, and you can complain to your data protection authority.

International transfers

SigDek's data is stored in the United States (the database in AWS US West, Oregon; files in Cloudflare R2's western North America location). Requests are handled at whichever Cloudflare location is nearest. Where the GDPR applies, we rely on the European Commission's standard contractual clauses for transfers.

Changes

We'll post changes here and email team owners about material ones before they take effect.