Privacy Policy

1.What we do not store

• Your source code. An analysis job creates a single-use isolated machine, shallow-clones the repository into a temporary working directory on it, runs the pipeline, and destroys the machine and its disk when the job ends. No copy of your repository survives the job, and none is kept in our database or in a backup.
• The code excerpts sent to the model. Prompt contents are not written to our database, and prompt-level debug logging is off by default in the cloud.
• Your git history, and any full-text index of your code. Doklo builds neither.
• Your personal GitHub access token. Repository access runs through the Doklo GitHub App installation, not through a token issued to you. The installation access token is not stored either — it is minted for each request from the App key and expires on its own.
• Commit messages and diffs from webhook deliveries. Incoming payloads are trimmed on arrival; we keep the identifiers we need to match a change against a document, not the change itself.
• Card numbers. Payment details go to Paddle and never reach our servers.
• Passwords. Doklo has none to store.

2.What we do store

Account

Your email address (it identifies the account and is how we reach you), the display name and avatar URL your sign-in provider gives us, the provider account identifier for each sign-in method you use, your workspace and your role in it, and notification preferences.

Sign-in itself stores as little as possible: a session record holds only a hash of the session cookie, and an email sign-in link is stored only as a hash, single-use and short-lived. The raw values exist in your browser and in your inbox, not in our database.

Repository connection

The GitHub App installation identifier, the account or organization it belongs to, the repositories you selected, and project settings. The App is installed with read-only access to repository contents — the least it can have and still read your code — plus the events that tell us a push happened. It has no write access.

Generated documents

The documents Doklo produces and the layers around them: each document's text, its source anchors (file paths and symbol names), logic hashes used for drift detection, confidence and priority, revision history, who approved what and when, and the artifacts and public slug of anything you publish.

Billing

Plan, subscription status and renewal date, the Paddle customer and subscription identifiers, and the billing country Paddle reports for tax. Invoices and payment methods live with Paddle.

Credentials you add

If you add your own Anthropic API key it is stored as sealed ciphertext plus the last four characters, which is all the interface ever shows. It cannot be read back in plaintext by any API response or log. Hosted MCP tokens are stored as hashes with a display prefix, and the full token is shown exactly once, when it is issued. Deleting either one deletes the row.

Operational records

Analysis job history, credit ledger entries (every grant, deduction and rollover — the record behind your balance), audit events for approvals, publications and credential changes, plus server and error logs. Server logs include IP address and user agent, which we use for security, abuse prevention and debugging.

3.Why we are allowed to process it

• Performing our contract with you — running your account, analysing the repositories you connect, storing and serving your documents, and billing you.
• Legitimate interests — keeping the service secure, preventing abuse of trial credits, and understanding usage in aggregate so we can improve Doklo.
• Legal obligation — keeping the tax and accounting records the law requires.
• Consent — optional product emails, which you can turn off at any time without affecting your account.

4.Who processes it with us

Doklo runs on a small set of providers. We do not sell personal data, we do not share it for advertising, and no processor below is allowed to use your data for its own purposes.

These providers operate in the United States and Europe, so using Doklo means your data is transferred there. Where a transfer leaves the EEA or the UK, it relies on the processor's Standard Contractual Clauses. We may also disclose data if the law requires it, and we will tell you unless we are forbidden to.

5.How long we keep it

• The temporary repository clone: minutes — it dies with the job.
• Account, documents and publications: for as long as your account exists.
• Deleting a project destroys its documents and takes its published pages offline. Deleting your account destroys the workspace — documents, publications, GitHub installation records, your API key and MCP tokens — within 30 days, backups included. Published URLs stop resolving straight away.
• Server logs: 90 days.
• Credit ledger and audit events: for the life of the account, because they are the record behind your balance and your approvals.
• Billing records: Paddle keeps invoices under its own obligations, and we keep the minimum subscription record that accounting law requires, even after an account closes.

6.Your rights

You can ask us to give you a copy of your data, correct it, export it, delete it, restrict or object to how we use it, or withdraw consent you gave. Deleting a project or closing the account does the deletion in one step, and where the product offers those controls directly you do not need to ask us at all.

For everything else, email hello@doklo.io from the address on the account. We reply within 2 business days and complete requests within 30 days. If we cannot confirm you control the account, we may have to refuse — that refusal protects you.

If you are in the EEA or the UK you can complain to your local data protection authority. In Korea, you can bring a complaint to the Personal Information Protection Commission.

7.Cookies

Doklo sets only cookies it cannot work without:

• doklo_session — keeps you signed in. HTTP-only, same-site.
• doklo_oauth_state and doklo_pkce — protect the sign-in redirect against forgery. They live for ten minutes and are deleted the moment they are used.

The marketing site also remembers your language choice in local storage. There are no analytics cookies, no advertising cookies, no third-party trackers and no cross-site profiling — which is why Doklo has no cookie banner to click away.

8.How we protect it

Traffic runs over TLS. Secrets you entrust to us — your API key, MCP tokens, sign-in tokens — are stored sealed or hashed, never in plaintext. Tenant isolation is enforced in the database itself with row-level security, not only in application code, so a bug in one query cannot hand another workspace's data to you. Analysis runs in isolated single-use machines with minimal network access.

No system is perfect. If you find a vulnerability, please report it privately to hello@doklo.io — we acknowledge within 2 business days. If a breach ever affects your personal data, we will notify you and the relevant authority as the law requires.

9.Children

Doklo is not for people under 16 and we do not knowingly collect their data. If you believe a child created an account, write to us and we will delete it.

10.Changes to this policy

When the product changes what it stores, this document changes with it, and the date at the top moves. For changes that materially affect how we handle your data, we will email account holders before they take effect.

11.Contact

MAYP, Republic of Korea — hello@doklo.io. See also the Terms of Service and the contact page.