Privacy policy

1.Who we are

Deftro is run by the operator of Deftro, which decides how the data below is used. Questions, requests and complaints go to sales@baton-vault.vercel.app; the Grievances page names the Grievance Officer and the times we answer in.

2.What we collect

What you give us, and what the service records as you use it:

• Account — the email address, name, profile picture and (with GitHub) user name that Google or GitHub send when you sign in, whether the provider verified the address, when you joined, and when you were last seen.
• Profile — your handle and display name, and whatever you add: avatar, website, bio, pronouns, company, location, time zone (only if you choose to show your local time), social links, pinned artifacts, and who invited you, if you joined through someone's invite link.
• Sign-ins — for each signed-in browser, its IP address and user agent, when it signed in, was last active and expires; and which provider you used. The provider's access tokens are stored encrypted and used only during sign-in, to read your profile.
• Tokens and devices — each API token's name, purpose, scopes, when it was last used and the user agent of its last request (never the token itself, only a hash), and each device's name.
• Install events — which reviewed version was installed into which agent on which machine, so the install ledger can show it.
• First-run answers — the role, use, tools and team size you pick after signing up, if you answer.
• Artifacts and versions — the files you publish with deftro publish or the upload page, their version history, and the hash of each version. Versions are immutable once published.
• Context snapshots — the files under .baton/ that deftro context push sends: memory, plans, decisions and worktree summaries, with the device name and author of each push.
• What you write — comments and Discussion posts, feedback requests and their images, issues, reports, proposals and review decisions; your stars, bookmarks and browser shortcuts.
• Organisations — your memberships and roles, and invitations you send (with the invitee's email).
• Activity — what was done in an account and by whom: publishing, reviewing, tokens created, and so on.
• Notifications — the notifications you receive and whether each email was sent.
• Staff log — if staff warn, suspend or ban you or sign you out, the action, the reason you are shown, and a note only staff see.
• Usage and errors — aggregate page views and page-load performance through Vercel Web Analytics and Speed Insights, which set no cookies and do no cross-site tracking; tokens in a page's address are removed before it is counted, and you can switch it off on the Cookies page. Server logs record the route, status, a request id and your user id (never your email); when a page fails, the error and the page's path go to them.
• Abuse limits — for visitors who are not signed in, a keyed one-way hash of the IP address counts requests per hour or per day and counts a Discussion view once a day; the address itself is not stored.
• Help questions — what you type into the help assistant (with email addresses, tokens and long numbers masked), the article it matched, whether it helped, whether you were signed in and the page you were on. It is not linked to your account.

Signing in is the only thing we need from you; everything else is optional. We do not buy data about you. Two steps happen by rule rather than by a person's decision: a public artifact or Discussion post reported by three established accounts is held back until a moderator decides, and a third removal by staff within 90 days suspends your community posting for 7 days. We make no other automated decision about you.

3.If you sponsor

Sponsoring is optional. If you never sponsor, none of this is collected about you. The rules for sponsoring are in the Sponsor Terms.

• Sponsor profile — whether you sponsor as a company or a person, your display name, website, country and billing email. Your display name and the amounts you bid are shown to signed-in people on each slot's bid board. Your billing email is kept with your sponsor profile and nothing is sent to it yet; notices about your bids and ads go to your account's email address.
• Application to advertise — the company, contact name, contact email and website you give when you apply, what you want to promote, and the decision. It is deleted when your account is erased.
• Payment and wallet data — each deposit's amount, currency, time and the payment provider's reference, and every wallet entry: deposits, locks, unlocks, charges, refunds and adjustments. No payment provider is connected yet; when one is, it will handle your card or bank details. Deftro does not store full card numbers.
• Terms acceptance — which version of the Sponsor Terms you accepted, when, and a keyed hash of the IP address you accepted from.
• Your ads — the images, video, headline, text and landing page you upload, and each review decision with its reason.

4.Sponsored impressions and clicks

When a Sponsored ad is shown or clicked, we add one to that ad's count for the day. To filter repeats and abuse, the visitor's IP address is turned into a keyed one-way hash; the address itself is not stored with the count. No cookie is set and no third-party ad script or tracker runs.

A click goes through a Deftro link that counts it and then sends you to the landing page the moderator approved. That site has its own privacy policy. Sponsors see daily totals only, never who saw or clicked an ad.

5.Never stored

• Worktree file trees — a context push records what each worktree is for, never the list of files in it or their contents.
• Device file contents — the CLI reads only the paths it publishes or syncs. Nothing outside those paths is uploaded, and a push that contains a credential is refused rather than stored.
• Full card numbers — Deftro does not take or keep them; a payment provider will, once one is connected.
• Your provider password — sign-in goes through Google or GitHub; we never see it.

6.Why, and on what basis

Where something rests on your consent, you can withdraw it at any time, as easily as you gave it.

7.Who sees it

• Anyone sees what you make public: your profile, public artifacts, Discussion posts and feedback.
• Members of an organisation see its artifacts, reviews and Activity, including what you did there.
• Deftro staff see what they need to moderate and to answer support requests.
• The companies on the sub-processors page process data on our instructions.
• An authority with a lawful order. We do not sell personal data or share it for advertising.

8.Where it is processed

The database is hosted by Neon in Singapore. The site runs on Vercel, images are stored by Cloudinary, email is sent by Resend, and sign-in goes through Google and GitHub, all based mainly in the United States (see sub-processors). India's DPDP Act allows these transfers. For people in the EU and UK, transfers rely on each provider's data processing terms: the European Commission's Standard Contractual Clauses, or the EU–US Data Privacy Framework where the provider is certified.

9.How long we keep it

• Account and profile — while your account exists. When you ask to delete your account, you are signed out and your API tokens stop working at once, and your profile and artifacts are hidden. We wait 14 days; if you sign in during that time, the deletion is cancelled and your profile and artifacts come back, but revoked API tokens stay revoked, so you create new ones. After the 14 days we erase them, except that your email address and name are held apart, read by nothing, for 180 days, as India's IT Rules 2021 require, and then deleted. Your old handle stays reserved, so it is never given to someone else. Image files you uploaded, such as an avatar, are no longer linked from your account, but the files stay on Cloudinary unless you ask us to remove them. If you sign up again after that, you start as a new, empty account.
• When a deletion waits or is refused — your account cannot be deleted while your community posting is suspended, or while a report about you or your content is open. A report only counts for 30 days from when it was filed, and only if the person who filed it is not banned and their account was at least 7 days old. A report or suspension that appears during the 14 days pauses the deletion until it no longer counts. So does holding the only owner role of an organisation or money in a sponsor wallet.
• Sign-in history — each sign-in records the provider you used, a keyed hash of your IP address, your browser's user-agent string, the time and the result. It is kept for one year, then deleted. When your account is erased, only the link to your account is removed; the rest stays until its year ends. Staff can compare addresses to look for repeat abuse, one case at a time, and the reason is logged.
• Identity blocks — if staff ban you, or your account is erased while you are banned or suspended, after your community posting has been suspended, within 90 days of staff warning or suspending you or removing your content, or with a report that counts as described above (or that was upheld in those 30 days), we keep a keyed hash of your provider identity and a keyed hash of your email address, so that person cannot simply sign up again. The hashes are not your address or provider id and we cannot read them back; the block also keeps the reason and the old account's internal id. A block lasts three years, then is deleted, unless staff lift it first. To appeal, follow the link on the page you see when your sign-in is refused, or write to sales@baton-vault.vercel.app.
• Browser sessions — a browser session lasts 7 days from its last refresh; expired ones are deleted daily.
• Tokens and devices — until you revoke them or delete your account. A revoked token stays as a record because Activity names it.
• Published versions — published versions are immutable and are never deleted: that is what makes a review mean something. Archiving an artifact hides it; deleting your account takes your artifacts out of public view and credits their history to “Deleted user”.
• Activity, reviews, reports, install events and the staff log — kept, and never edited. They point at an id rather than at your name or email, so once your account is deleted they no longer name you.
• Comments and posts — kept, credited to “Deleted user” after you delete your account. Ask us to remove a particular post.
• Context snapshots — each context space keeps its newest 20 snapshots; older ones are deleted after every push. Deleting a space removes all of its snapshots, and deleting your account deletes your personal spaces.
• Logs — server logs follow Vercel's retention. Activity and sign-in history, kept as described above, are our records of processing for at least one year, as India's DPDP Rules 2025 require.
• Abuse limits — the hashed counts are deleted after two days.
• Help questions — deleted after 90 days.
• Removed content — content removed for breaking the Terms, and its records, are kept for at least 180 days.

Wallet entries are the record of money moved, so they are never edited or deleted while your account exists. If you close your account, we keep them, with your sponsor profile's billing email and country, for as long as the law requires for financial records; your sponsor display name and website are removed from bid boards. Daily impression and click counts are kept with the ad they belong to. Ads and their review decisions are kept so a takedown or refund can be explained later.

The database host keeps a short history so the database can be restored. If it is ever restored, we erase again the accounts our record shows were deleted since that point.

10.Your rights, and how to use them

• See and download your data — Settings → Security → Download your data gives you a JSON file of what we hold about you, leaving out keyed hashes and notes only staff see. Ask us for the list of companies it was shared with.
• Correct it — edit your profile in Settings → Profile. Your email comes from your sign-in provider; to change it, write to us.
• Delete it — Settings → Security → Delete your account. What is kept, and why, is under How long we keep it. The only owner of an organisation must hand it over or delete it first.
• Withdraw consent or object — switch analytics off on the Cookies page, turn notification email off from any email or your Notifications page, or delete your account.
• Nominate someone — under India's DPDP Act you may name a person to use these rights if you die or cannot act. Email us their name and contact details.
• Complain — to our Grievance Officer (Grievances), then, if you are not satisfied, to the Data Protection Board of India, or the data protection authority where you live in the EU or UK.

Write from the address you sign in with, so we can tell the request is yours, to sales@baton-vault.vercel.app. We acknowledge within 24 hours and answer within the times on the Grievances page, and at the latest within one month.

11.Children

Deftro is for people aged 18 or over; signing in confirms you are. We do not knowingly hold data about anyone younger, and we delete an account when we learn it belongs to a child.

12.Cookies

We use the cookies Deftro needs to sign you in and remember your settings, and no advertising cookies. Each one is listed on the Cookies page.

13.Protecting it

Traffic is encrypted in transit. Provider and GitHub tokens are encrypted at rest; API tokens are stored as hashes; IP addresses kept for abuse limits are keyed hashes. Access to production data is limited to the people who run the service. If a breach puts your data at risk, we tell you and the authorities without delay, with what happened and what you can do.

14.Changes

When this policy changes, the version and date above change with it. We tell signed-in people about a change that affects them, in the app or by email, before it takes effect.

15.Contact

Questions about your data, or a request about it: sales@baton-vault.vercel.app.