Privacy Policy

This Privacy Policy explains what information Edibu, LLC (“Edibu”, “we”, “us”) collects when you use Nightgauge, why we collect it, and the choices you have. It covers:

• the website at nightgauge.dev, including the early-access and support forms;
• the Nightgauge VS Code extension, CLI and SDK (the “local core”), which are open source under the Apache 2.0 license;
• the optional Nightgauge hosted platform at api.nightgauge.dev, and the web dashboard and mobile app that connect to it (together, the “Platform”).

The short version: the local core runs on your machines and sends us nothing about your work on its own until you turn on its cloud features, which are off by default. With them on, it sends run telemetry: for each pipeline run, the repository and issue it worked on (including the issue’s title, labels and the start of its body), how the run went and what it cost, so the dashboard and mobile app can show you your runs. Your source code, prompts and credentials never leave your machine through Nightgauge, with one exception: if your team uses workspace conversations on the Platform, the text of those conversations (the messages, the replies, and any code or issue text they quote) is sent to and stored on the Platform, where your team reads it (§ 3). Your model-provider keys never leave your machine, conversations included. What we do collect is listed below, and you can turn it off. Nightgauge 0.5.1 and earlier behave differently; § 2 says how.

1. Information the local core handles

The extension, CLI and SDK read your repository, your issue tracker and your AI provider accounts on your behalf, on your machine. That data is processed locally and sent directly from your machine to the providers you configure (your git forge, your model provider, your chat workspace). Edibu does not sit in the middle of those connections and does not receive that data. The one exception is a workspace conversation: its text passes through and is stored on the Platform, as § 3 describes.

Credentials you enter into Nightgauge (forge tokens, model API keys, chat bot tokens, license keys) are stored in your operating system’s secure credential store via VS Code’s secret storage. They are redacted from logs, from the settings view and from every notification the pipeline sends.

2. Product telemetry

Nothing is sent on its own until you turn cloud features on. The local core’s cloud features are off by default. You turn them on in your machine-wide Nightgauge configuration (platform.enabled: true), or for the CLI with a license or API key set in its environment. Signing in, activating a license and starting a trial do not turn them on, and a repository’s own configuration cannot.

With cloud features off, the Platform hears from your machine only when you act: when you sign in or out, activate a license, start a trial, manage your subscription, open a tab of the extension’s dashboard that shows your account’s cloud data, or upload past run history with nightgauge pipeline backfill. Each sends what that action needs; activating a license, for example, sends the key you entered with your machine’s id, hostname and operating system.

Run telemetry. With cloud features on, and while you are signed in or have added a license key, the local core sends run telemetry to your account. It is on by default. The extension tells you what it shares when you first activate it and offers to turn it off, the CLI prints the same notice the first time it runs with cloud features on, and both tell you again when what is shared changes. You can turn it off at any time in Settings (nightgauge.telemetry.enabled) or in the machine-wide configuration (platform.telemetry.enabled: false), and VS Code’s global telemetry-off setting is honored as a hard stop. A repository cannot override either setting.

In Nightgauge 0.5.1 and earlier, signing in or adding a license key is enough for run telemetry to be sent, whether or not cloud features are on, and while you are signed in or have a license key, each VS Code run’s record (the issue title, labels and body excerpt included) is sent even with telemetry turned off. To stop that on those versions, sign out and remove any license key, or update to a later release.

For each pipeline run, run telemetry contains:

• the repository slug (owner/name), the issue number and a run id, used as correlation keys so that runs can be listed in the dashboard and mobile app;
• the issue’s title (up to 256 characters), up to 50 of its labels and the first 8,192 characters of its body, so the run detail can show what the run was for. The excerpt is the issue’s own text, sent as written;
• the branch of a run the autonomous scheduler started;
• the outcome, timings, token counts and cost of the run and of each stage, the model and adapter each stage used, the predicted and actual issue size, retries and the path the run took through the stages;
• a failed stage’s error message, up to 2,000 characters;
• the run’s decision trace: each stage’s start and exit, each model-routing decision with the router’s reasoning, and each gate’s result with its reason and evidence;
• pipeline health counters, recommendation outcomes and anonymized workflow summaries (agent tree and judge verdicts, without content);
• the issues queued on that machine, each with its number, title, repository, position, priority and status.

Telemetry never contains source code, file contents, prompts, secrets, tokens, API keys or environment variables, issue or pull-request comments, or repository URLs. Commit SHAs are sent only by the audit trail below, and only if you set it up. Three fields carry text as written: the issue-body excerpt, a failed stage’s error message, and the decision trace’s reasons and evidence. They are bounded in length but not redacted, so they can quote a file name, a line of command output, the agent’s last message or anything the issue says. Turn off the trace stream to keep the decision trace on your machine.

Why. Run telemetry is what the dashboard and mobile app show you: your run list and run detail, runs in progress, cost and token use, and the queue across your machines. It also feeds the analytics that tune the pipeline. It is stored with your account, and a run is visible to you and to the members of the team it belongs to, unless you started it as a private run (§ 3).

What cloud features send. With cloud features on, your machine also registers with the Platform and sends a heartbeat every 30 seconds: its machine id, a random id for each window, the Nightgauge version, the repositories and workspace it serves, the adapter and model it runs and, as platform.telemetry.usage_reporting allows, your AI provider allowance and spend. It keeps a connection open for the commands you send it from the dashboard or app, shares the decisions a run is waiting on (their text, repository, issue and branch), keeps your session and license current, and checks every minute that the Platform is reachable. If you set up the audit trail, the extension also sends an event for each pipeline and stage, each skill it invokes and each commit a run validates, by SHA, to the Platform’s audit and compliance views. Turning cloud features off stops all of this, unless you set NIGHTGAUGE_AUDIT_ENABLED for the audit trail; the telemetry switches stop only the allowance and spend report.

The complete field list, the schema and deletion instructions are published in TELEMETRY_PRIVACY.md in the open-source repository, and the code that builds each payload is public.

Telemetry events are kept for at most 90 days and then deleted; aggregated counters, which hold no per-event row, may be kept longer. Run records, the issue title, labels and body excerpt included, are your run history in the dashboard and are kept with your account until you ask us to delete them. You can request deletion at any time (see § 9).

3. Platform accounts

If you create a Platform account or use a license key, we collect:

• your name, email address and authentication identifiers (for example a GitHub account identifier when you sign in with GitHub, or a device code grant when you sign in from the mobile app);
• team and organization membership, roles and audit-log entries of actions taken in the dashboard;
• license state and, for paid plans, the billing records our payment processor returns to us (we never see or store full card numbers);
• the telemetry described in § 2, associated with your account or team;
• if your team uses them, the text of workspace conversations, described below.

Team and private sessions

Every pipeline run and every conversation on the Platform is either a team session or a private session. Its creator chooses when creating it, and team is the default. Runs the autonomous scheduler picks from the board are always team sessions.

• Team (the default). Every member of the team that owns the session reads it, viewers included, and no other team does.
• Private. Private content is readable only by its creator. Every other account, the team’s owners and admins included, cannot read it, and the Platform does not send its content to them. Once a session is private, nothing makes it a team session.
• What private does not hide. Work on GitHub (branches, pull requests, issues, comments and board moves) follows the repository’s own permissions.
• What owners and admins still see. The team’s owners and admins still see that the session exists and what it cost: who created it, on which workspace, when, its state, the model, the tokens and the cost. Never its content. The team pays for the session and its owners and admins set its budget.

Workspace conversations

A workspace conversation is a chat thread between your team and the agent on one of your team’s workspaces, in the extension, the web dashboard or the mobile app. When your team uses them:

• What crosses and is stored. The messages members post; the replies the workspace’s model writes, as they stream and as the final message; any code or issue text a message or reply quotes; and references a reply makes to an issue, a board card or a run. The Platform stores this as text and returns it to readers. It never executes it.
• Who reads it. Every member of the conversation’s team, viewers included, and no other team, unless the conversation is private, in which case only its creator reads it.
• Where it goes next. A later turn sends the stored conversation text to the team workspace that answers it, and from that machine to the model provider that workspace is configured with, under that workspace operator’s own agreement with the provider (see § 6). A private conversation is answered only by its creator’s own machines.
• Redaction. The workspace redacts credential shapes (keys, tokens, passwords) from a message before it leaves the machine, and the Platform refuses a message that still contains one. The team’s owners and admins can redact any message in a team conversation, and the creator of a private conversation any message in it; a redacted message’s text is removed from storage, from replay and from the context of later turns.
• No content in logs. Conversation text never enters our application logs, traces, error reports or metric labels. The audit log records who did what and when, never the text.
• What still never crosses. The Platform holds no model-provider key. The model call is made by your team’s own machine with its own credentials, and a conversation adds no key to the Platform.

4. The website

Early-access and support forms. When you join the waitlist we store your email address (and name, if given) and add it to our launch mailing list; you can unsubscribe from any message. When you contact support we store the message and reply by email; support requests are not added to any marketing list. Both forms are protected by Cloudflare Turnstile, which may process your IP address and browser signals to distinguish people from bots.

Analytics and logs. nightgauge.dev is served by Cloudflare, which keeps standard edge request logs (IP address, user agent, requested URL) for security and abuse prevention. We may use Cloudflare Web Analytics, which is cookie-less and does not track you across sites. We do not use advertising trackers, and the site sets no cookies of its own.

5. How we use information

We use the information above to provide and operate Nightgauge; to show you your own runs, costs and history in the dashboard and mobile app; to detect and fix failures; to secure accounts and prevent abuse; to respond to support requests; to send launch and product announcements you signed up for; and to comply with law. We do not sell personal information and we do not use your telemetry or code to train AI models.

6. Sub-processors

We share data only with the service providers below, only as needed to run the product, and under contracts that restrict their use of it.

Model providers and chat workspaces (Slack, Discord, Mattermost) are services you connect Nightgauge to with your own credentials. Their handling of that data is governed by their own terms and privacy policies.

We will update this table before adding a sub-processor that handles personal information.

7. Security

Credentials are held in your operating system’s secure store, never in plain files or YAML. Transport is TLS everywhere. The Platform runs behind Cloudflare with no publicly exposed origin ports. We run secret scanning, dependency scanning and static analysis on every change, and publish a security policy and a disclosure channel at github.com/nightgauge/nightgauge/security/policy (security@nightgauge.dev). No system is perfectly secure; if we learn of a breach affecting your personal information we will notify you as required by law.

8. Retention

• Telemetry events: at most 90 days, then deleted. Aggregated counters, which hold no per-event row, may be kept longer.
• Run records (§ 2), the issue title, labels and body excerpt included: kept with your account as your run history in the dashboard until you ask us to delete them.
• Platform account, team and audit data: for as long as your account exists, and up to 30 days after you delete it.
• Workspace conversation text: for as long as the conversation exists. A conversation with no activity for 12 months is deleted automatically, whole, and a team’s owner or admin can delete one at any time. Erased text is handled as § 9 describes.
• Waitlist and support email: until you unsubscribe or ask us to delete it.
• Edge request logs: per Cloudflare’s retention, typically days.

9. Your choices and rights

You can leave cloud features off, turn telemetry off in Settings, disable individual streams, ask us to delete your run records or your Platform account, unsubscribe from any email, and uninstall the extension — which removes its local state with it.

Depending on where you live you may have the right to access, correct, export or delete personal information we hold about you, to object to or restrict certain processing, and to lodge a complaint with a supervisory authority. To exercise any right, email privacy@nightgauge.dev. We answer within 30 days and never charge for a reasonable request. We do not discriminate against you for exercising your rights.

To request deletion of your Platform account and its data specifically, see Delete Your Account & Data for what gets removed and the retention window that applies.

Erasing your conversation text. You can ask us to erase the text you contributed to workspace conversations, and your team’s owner or admin can ask on your behalf. When it is erased, your messages, the replies to them and the titles of conversations you started are removed at once from everything the Platform shows, replays or streams, and the original records are deleted within 30 days.

International visitors. Edibu is located in the United States and the Platform is hosted there. If you use Nightgauge from outside the United States your information is transferred to and processed in the United States.

10. Children

Nightgauge is a developer tool and is not directed to children under 16. We do not knowingly collect personal information from children.

11. Changes

We will post any change to this policy on this page with a new effective date and, for material changes, notify Platform account holders by email before the change takes effect.

12. Contact

Edibu, LLC · privacy@nightgauge.dev · nightgauge.dev/support