Who controls your data
Alkimist is an independent, founder-operated software service. For privacy questions, requests, or complaints, email [email protected]. This policy applies to alkimist.dev and the Alkimist service.
Data we collect
- Account data such as email address, confirmation and sign-in records.
- Repository connection data, including a GitHub App installation identifier or encrypted legacy provider tokens.
- Infrastructure data such as server labels, IP addresses, deployment configuration, generated public keys, and encrypted generated private keys.
- Project configuration, encrypted environment secrets, deployment logs, health results, metrics, audit events, and support messages.
- Billing identifiers and subscription state from Stripe. Alkimist does not store full card numbers.
- First-party product events such as landing, signup, connection, and deployment milestones. These use a random visitor identifier and do not store an IP address or browser user-agent in the product-events table.
Why we use it
We use the data to provide and secure the service, authenticate users, carry out requested deployments, process subscriptions, troubleshoot failures, prevent abuse, communicate about accounts, and understand whether onboarding works. The usual legal bases are performing the service contract, legitimate interests in operating and securing the service, consent where required, and compliance with law.
Providers and transfers
Data may be processed by infrastructure and service providers needed to operate Alkimist, including Cloudflare, Stripe, Zoho Mail, GitHub or GitLab, and an AI provider selected by the user when an AI feature is invoked. Each provider processes data under its own terms and locations. Alkimist does not sell personal data.
Cookies and analytics
Alkimist uses essential session, security, preference, and signed first-party analytics cookies. It does not load third-party advertising trackers. A browser Do Not Track value of 1 disables new product-event collection.
Retention and deletion
Account and operational data is kept while needed to provide and secure the service. Audit-event retention is configurable from 7 to 365 days. When you delete an account, it is scheduled for permanent deletion after a 30-day recovery window. Limited copies may remain temporarily in backups or where retention is required for security, billing, disputes, or law.
Your choices and rights
Depending on your location, you may request access, correction, deletion, restriction, portability, or objection, withdraw consent, and complain to a data-protection authority. You can also revoke Git provider access, delete generated SSH keys, cancel billing, and delete your account in product settings. Email [email protected] to make a request; identity verification may be required.
Security and changes
Alkimist uses encryption, access controls, signed requests, and audit records appropriate to the service, but no internet service can guarantee absolute security. Material policy changes will be posted here with a revised date and, when appropriate, communicated to account holders.