Privacy policy

• Your account: your email address, name, avatar and login, from the provider you sign in with.
• Your organization: its name, its members and their roles, and invitations, which name an email address or a GitHub login.
• Check results from hushrun run: the check's name, its run key and digest, pass, fail or skip, the command, the commit, the repository, timings and the CI run's link, and who sent it.
• Events in each repository on hushrun: signed records of checks, artifacts, deploys and approvals, with digests, artifact references and run links.
• Your policy: the whole hushrun.yaml of each repository on hushrun, so an event can be checked against it.
• The transparency log: each repository's append-only log of its events and deletions, which the server signs.
• The audit log: every admin action in an organization, with who did it.
• Machines and agents: each machine's host name and client, when it was last used, the public half of each machine's and agent's key, and a hash of each token, never the token itself.
• Billing: the plan, usage counts, and what Creem reports about payments, such as a subscription's status. Card details stay with Creem.
• Forms on this website: what you send when you ask for help or a report, or write about Scale or Enterprise. That is your email address and, where the form asks, your name, company, role, team size, coding agents, CI spend, compliance needs, the calculator's numbers and your message. hushrun notes whether your coding agents and CI spend call for a conversation. Each comes with the page's language, and most with the campaign and page that brought you here.
• Email: what you write to hushrun's support address, and the replies.
• Server logs: each request's IP address, time, path, status and browser details.

Command lines and paths you run through hushrun run are part of its results, so keep secrets and personal data out of them.

The CLI has no telemetry. At a terminal, it asks GitHub about once a day whether a newer release is out, so GitHub sees your IP address: set HUSHRUN_NO_UPDATE_CHECK to turn that off. Results kept on your own machine, or on a server you run, send nothing to hushrun.

• To run the service: signing you in, recording and showing your organization's checks, and applying its plan and limits.
• To bill: working out usage, and telling Creem which organization a payment is for.
• To write to you: usage alerts, decisions on open source applications, changes that matter to the terms, and answers to what you ask.
• To keep it safe: rate limits, debugging, and stopping abuse.
• To follow up on a form: what you send in one is used only to write to you about hushrun.
• To see how the website is used: only if you accept analytics.

Where the law asks for a legal basis: running the service and billing are needed for your agreement with hushrun, keeping it safe and answering you are legitimate interests, and the forms and analytics rest on your consent. In Colombia, signing up or sending a form is your authorization to treat your data this way, and you can withdraw it at any time.

hushrun shares data only with the services it runs on, and only what each one needs:

• Google Cloud hosts the service and its database, in the United States, and keeps the server logs.
• Cloudflare runs the domain's DNS, and carries the email hushrun sends and receives.
• Creem is the merchant of record. It receives your email address and your organization's identifier from hushrun, and collects your card and billing details itself, under its own privacy policy.
• GitHub signs you in, and hosts the CLI's releases.
• Google keeps the email sent to and from hushrun's support address, in Gmail, and runs Google Analytics if you accept it.
• Sigstore certifies signatures in GitHub Actions. Its public log records the repository's and the workflow's names, and the docs show how a private repository can stay out of it.

hushrun also discloses data when the law requires it.

hushrun operates from Colombia, and its database is in the United States, on Google Cloud, so using the service sends your data there. The services above may process it wherever they operate, under their own safeguards.

• Each plan names the history it includes: 30 days on Free, and a year on Team and Growth. Today the hosted service deletes no history on its own.
• An organization's admins and owners delete old events with hushrun repository gc. It removes an event's contents; the transparency log keeps a record that the event existed, its hash, and who deleted it, so a deletion can be checked.
• Check results and the audit log are kept while the organization exists.
• A person's machine unused for 90 days is revoked, and agent tokens expire, after 365 days at most. Revoking stops what comes next; what was signed before stays.
• Server logs are kept for 30 days.
• Database backups are kept for up to 14 days, so what is deleted can stay in a backup until then.
• What you send in a form, and email to support, are kept until you ask hushrun to delete them or they're no longer needed.
• Billing records are kept as long as tax law requires, and Creem keeps its own.

Wherever you live, you can ask hushrun what it holds about you, have it corrected or deleted, get a copy, object to a use, or withdraw a consent. Write to support@hushrun.com from your account's email address. hushrun replies within 3 business days, and finishes within 15 business days.

hushrun deletes an account or an organization when you write. A deletion can't reach the transparency log's record of an event, or billing records the law requires hushrun to keep.

You can also complain to your data protection authority: in Colombia, the Superintendencia de Industria y Comercio (SIC).

hushrun's website counts visits with Google Analytics, only if you accept. Until you do, it loads nothing from Google and sets no cookies.

• If you accept, Google Analytics sets two cookies on this website: _ga, which tells visitors apart, and _ga_ followed by an ID, which keeps track of a visit. Both last up to two years.
• Your browser then sends Google the pages you open, the page you came from, details of your device and browser, and what you do on the site, such as copying a command or choosing a plan.
• hushrun uses this only to see how the website is used, with Google's advertising features off. Emails, names and companies are never sent to it. Google keeps this for up to 14 months.
• Google explains what it does with this information in How Google uses information from sites or apps that use our services.
• To change your choice at any time, use Cookies in the footer. Declining deletes these cookies and stops Google Analytics here. Your choice stays in your browser's storage, not in a cookie.

• This website sets no cookies of its own. Your browser's storage keeps your cookie choice and, until you close the tab, the campaign that brought you here, to go with a form you send.
• The dashboard sets only what it needs to work. hushrun_session keeps you signed in for 30 days, and hushrun_oauth protects a sign-in in progress. hushrun_last_method and hushrun_org remember, for a year, how you last signed in and which organization you last opened. Your browser's storage keeps your light or dark theme and, once you sign something in the dashboard, that browser's signing key, which can't be read back out.

Connections use HTTPS, and tokens and sessions are stored only as hashes. No service is perfectly secure: if a breach puts your data at risk, hushrun tells you, and the authorities where the law requires it.

hushrun is for people who build software at work. It isn't meant for anyone under 18, and hushrun doesn't knowingly collect their data.

When this policy changes, this page shows the new version and its date. When a change matters to how your data is used, owners and admins get an email before it takes effect.

Write to support@hushrun.com. hushrun replies within 3 business days.