Privacy
What this site does, in claims you can check in a browser.
The first section describes this website and every line is verifiable from your own developer tools. The clauses after it separate what is true today from the legal wording a reviewed document has to supply. Nothing on this page is in force.
01This website
Five claims, and how to falsify each one.
Every claim below is about a static site and can be checked from the network and storage panels of the browser you are reading it in.
No cookie is set by this site
Open your browser’s storage panel on any page here: the cookie list for this origin is empty. There is no consent banner because there is nothing to consent to.
One value is kept on your device, and it never leaves it
The theme control writes credda-theme to localStorage so the page does not flash the wrong colours on your next visit. It is read before paint by a script in the document head and is never sent anywhere.
The fonts come from this origin
Inter and JetBrains Mono are downloaded during the build and served from this site. Your browser makes no request to Google to render this page.
One field posts, and only when you press it
Nothing here sends anything while you read. The waitlist field on the contact page is the single exception: pressing its button makes one request, to our own endpoint on our own infrastructure, carrying the address you typed and the name of the page it came from. Watch it in the network panel. Every other button on that page opens a draft in your own mail application.
No advertising, no social embeds, no session recording
No advertising network, no tracking pixel, no embedded social widget and no session replay script is loaded on any page of this site.
02The policy
The clauses, and what each one is still missing.
Two halves per clause, as in the terms draft. What is true today was read out of the product; what is pending is named rather than approximated.
1. This website
Today
Described in full in the section above, and checkable. The short version: no cookie, no advertising, no cross-site identifier, and one theme preference held on your own device.
Pending review
The controller’s legal identity and contact details, the lawful basis under GDPR for each processing activity, and the retention period for any server log kept by whoever hosts this site.
2. Measurement
Today
This build loads no analytics at all. No measurement script of any kind is served on this site, and no page view is reported anywhere. If that changes, the intended replacement is Cloudflare Web Analytics, which sets no cookie and carries no cross-site identifier, and this section will describe it in these words instead. It is wired to a build variable, so this paragraph follows the build rather than someone remembering to edit it.
Pending review
If measurement is turned on: the data processing agreement with the provider, the retention period, and the legitimate interest assessment.
3. When you write to us
Today
Contact happens by mail. Your message and your address are held in a mailbox and are used to reply to you. The one exception is the waitlist field on the contact page: the address you type there is sent to us when you press the button, and is stored so we can write to you when Credda opens.
Pending review
The mail provider, where that mailbox is hosted, how long correspondence is kept, and the process for a deletion request.
4. When Credda runs on your repository
Today
This is separate from the website, and it is the part that matters. Credda reads a repository’s code and its issue text, executes that repository’s own commands in a sandbox, and records evidence about what happened. Command output is scrubbed for credential-shaped text before anything durable is written, and that scrubber recognises the shapes it knows and nothing else. The issue title and body are stored as they arrived. The security page sets out where the data goes and what is not covered.
Pending review
Sub-processors, including the model provider, and the regions they operate in. Retention of investigations, evidence and artifacts. Whether any customer content reaches a model that trains on it, which today it does not, and a commitment to that in writing. Data processing terms for customers who need them.
5. Your rights
Today
The only thing this site holds about you is a waitlist address, and only if you typed one in. Ask and it is deleted. For anything Credda holds from a run, ask and it will be answered specifically rather than from a template.
Pending review
The GDPR and CCPA rights sections, the identity verification process for a request, the response window, and the supervisory authority a complaint goes to.
6. Children
Today
Credda is a developer tool with no consumer surface and is not directed at children.
Pending review
The standard statement, and the minimum age, in enforceable wording.
7. Changes
Today
This page is a draft and will be replaced in full by a reviewed document. That replacement is not a change of policy, because this one has never been in force.
Pending review
How a change is notified and when it takes effect.
If a procurement or security review needs a pending item before the document exists, ask. Write to legal@credda.io. See also the terms draft and the security page, which is not a draft.