Privacy policy

Who we are

Kaptimus is run by the maker of Kaptimus, in India. This page says what information Kaptimus keeps about you and about the GitHub accounts you monitor, why it keeps it, where it is kept, and what you can ask us to do with it. It is written in plain words on purpose.

What Kaptimus reads from GitHub, and what it never reads

Kaptimus is a GitHub App. When an owner installs it on a GitHub account, GitHub lets it read these things, and nothing else:

• Actions runs and jobs — which workflow ran, when, for how long, on which kind of machine, and how it ended. This is what the costs are worked out from.
• Repository names — so a run can be shown under its repository.
• Self-hosted and larger runner details — the size of the machine a job ran on, which decides its price.
• Organization members and their roles — so Kaptimus can tell who is an owner, and show an account only to people GitHub says may see it.
• Your email address — when you sign in, so we know who you are.

Kaptimus never reads your source code, your secrets, the files your jobs produce, or the text of your job logs. It does not ask GitHub for permission to, and GitHub would refuse if it tried.

What we keep about you

When you sign in with GitHub, Kaptimus keeps:

• your GitHub username, your GitHub user number, your name, your email address, and the link to your profile picture — these come from your GitHub account;
• a sign-in key for GitHub, so Kaptimus can ask GitHub what you may see. It is stored encrypted and used for nothing else;
• a record of your sign-in: the address your browser came from and the browser's name. A sign-in lasts 7 days;
• which GitHub accounts you may see in Kaptimus, and as what — an owner, a CI/CD Admin, or the admin of some repositories. GitHub decides this; Kaptimus only writes down the answer;
• if you send the feedback form: your score, the options you ticked, what you typed, and the page you sent it from. It is kept with your user record, so we know who said it;
• when Kaptimus may next ask you for feedback, and your last answer to that question (later, no thanks, or that you sent the form), so it does not ask you too often.

What we keep about the accounts you monitor

When an owner ticks a GitHub account in Kaptimus, Kaptimus records every GitHub Actions run of every repository GitHub gives it there. For each run it keeps:

• the repository name and whether it is public or private;
• the workflow name and its file path;
• the run number, how it was started, the branch, the commit id and the commit message;
• the GitHub username of the person who started the run, or the name of the bot that did;
• each job: its name, when it started and ended, how it ended, the runner it ran on (its name, labels and machine size), and the minutes and price Kaptimus worked out.

So Kaptimus holds the usernames of people in your organization who start workflows, even if they never use Kaptimus themselves. The owner who ticked the account chose to monitor it; if you are one of those people and have a question, ask that owner, or write to us.

Why we keep it

• to show you what each run, workflow and repository costs — the whole point;
• to let you sign in and to show each person only what GitHub says they may see;
• to find and fix problems — Kaptimus writes a log of what it did and what went wrong;
• to learn what to make better, from the feedback you choose to send.

We do not sell your information. We do not show advertisements. We do not use it to build a profile of you for anyone else.

What Kaptimus does not do today

• It sends no emails. Nothing is sent to your address today.
• It runs no analytics or tracking scripts, and no third-party code on the pages. The only cookies are the ones the sign-in needs. Your browser also remembers, on your own computer, whether you folded the side menu — that is not personal information.
• It shares nothing with anyone except the services named below.

Where it is kept, and who helps us run Kaptimus

• GitHub is where the information comes from. Kaptimus reads it through the GitHub App you installed.
• Vercel runs the website and its code.
• Neon holds the database, on servers in the United States (AWS, us-east-1).

Everything travels between your browser, Kaptimus and GitHub over an encrypted connection (HTTPS). The GitHub keys Kaptimus holds for you are encrypted in the database.

How long we keep it

• Runs: the current month and the 6 months before it. Older runs are deleted.
• Your sign-in details: while you use Kaptimus.
• Feedback you sent: kept with your user record. Write to us and we will delete it.
• Accounts: when the App is uninstalled from a GitHub account, Kaptimus stops reading it at once. The account and its runs are marked uninstalled and kept, so they are there again if the App is installed again. If you want them deleted instead, write to us.
• Logs: the log of what Kaptimus did (with user ids, GitHub usernames and repository names) is kept for as long as we need it to run and fix the service.

What you can ask us

Write to hello@kaptimus.com from the email address on your GitHub account, and we will:

• tell you what we keep about you, and send you a copy;
• correct anything that is wrong;
• delete your sign-in record and your keys. If you are the owner of a monitored account, we will delete that account's runs too, when you ask.

You can also act without us: uninstall the Kaptimus App from your GitHub account (GitHub settings → Applications → Installed GitHub Apps), and take back your sign-in (GitHub settings → Applications → Authorized OAuth Apps). Kaptimus stops reading at once.

Depending on where you live, the law may give you more rights over your information (for example under India's Digital Personal Data Protection Act or the European GDPR). Write to us and we will help.

Children

Kaptimus is for people who work with GitHub Actions. It is not meant for children, and we do not knowingly keep information about anyone under 16.

Changes to this page

When this page changes, the date at the top changes with it. If a change matters to you — something new we keep, or someone new who helps us run Kaptimus — we will say so on the site before it takes effect.

Contact

hello@kaptimus.com