Privacy policy

Kodmos is responsible for the personal data described here. Write to [email protected].

• Your GitHub account: its id, username, name, avatar and primary verified email address, when you sign in with GitHub.
• What you set in Kodmos: another email address, which emails you want, your language and timezone.
• Organizations you connect or join: their GitHub name, avatar, the members GitHub lists, and your role in Kodmos.
• What happens in an organization: flows, deployment events, the branches people answer with, runs, the commits deployed, teams, invitations and access requests, and an audit log of who did what.
• From your repositories, through the GitHub App: repository, branch and workflow names, workflow files (to read their inputs), commit metadata (sha, message, author, date) and the status of workflow runs. Kodmos does not copy your source code.
• Emails Kodmos sends, kept as copies in the organization’s outbox (its newest 300) and in your settings. Links only you may use are removed from those copies.
• Technical data: a session cookie, the address your requests come from (counted in memory to stop abuse, not stored), and error reports.

• To provide Kodmos to you and your organization (performing our contract): signing you in, planning and deploying releases, and emailing the people involved.
• To keep Kodmos secure and working (our legitimate interest): rate limits, error reports, backups, and the audit log your organization relies on.
• To bill paying organizations (our contract, and legal obligations for invoices and taxes).

We do not sell personal data, do not use it for advertising, and do not use your organization’s data to train AI models.

Only the services Kodmos runs on, each under a data processing agreement:

And when the law requires it.

Kodmos runs on Railway, and its services may process data outside your country, including in the United States. Where data leaves the European Economic Area or the United Kingdom, the transfer relies on the European Commission’s standard contractual clauses or an equivalent safeguard.

• Your account: until you delete it (on your account page).
• An organization’s data, including its deployment history and audit log: until the organization is removed from Kodmos. Removing it erases everything in it.
• Email copies: the newest 300 per organization.
• Error reports: up to 90 days. Backups: up to 30 days.

When you delete your account, your profile, addresses and settings are erased, also from kept email copies. What you did in an organization (an answer, a deploy) stays in its history and audit log under your GitHub username, because the organization needs that record.

You can see and change your data on your account page, and delete your account there. You may also ask us for a copy of your data, to correct it, to erase it, to restrict or object to its use, and to move it elsewhere; and you may complain to your data protection authority.

Write to [email protected].

Kodmos uses only the cookies it needs to work: your session, the sign-in round trip with GitHub, and the organization you last opened. Your theme is kept in your browser’s storage. No analytics or advertising cookies.

Kodmos is for work and not meant for anyone under 16.

When this policy changes in a way that matters, we say so by email to organization owners before it applies. The date at the top is when it last changed.