Legal
Privacy Policy
This policy explains how Wyrm processes personal data in line with the EU General Data Protection Regulation (GDPR / RODO). The Wyrm desktop app is local-first: it reads and works with your repositories entirely on your own machine.No repository content, commit messages, or file contents are transmitted to us; in the optional diagnostics described below, file paths in your home folder are reduced to file names. We never sell, rent, or monetise your data. The processing described below relates only to the website, your account, billing, messages you send us, and — if you explicitly opt in — crash diagnostics and diagnostic reports.
Data controller
The controller responsible for your personal data is:
- Business name
- Andrii Romaniuk (sole proprietorship)
- Registered address
- ul. Długa 29, 00-238 Warszawa, Polska
- Privacy contact
- privacy@wyrmflow.com
We have not appointed a Data Protection Officer, as we are not legally required to do so. For our contact and identification details, see our legal information page.
What we process, and why
We process personal data only for the purposes below, each with its legal basis under Art. 6(1) GDPR:
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Account & authentication — creating your account and keeping you signed in | Email address, authentication metadata. If you sign in with GitHub, Google, GitLab, or Apple, the provider shares your email address, its account identifier for you, and the basic profile details it returns (such as your name and avatar URL) with our authentication service. | Performance of a contract — Art. 6(1)(b) | For the life of your account; deleted on account deletion |
| Billing & subscriptions — processing payments and issuing invoices | Email, billing details, subscription & payment records, tax ID where provided | Performance of a contract — Art. 6(1)(b); and compliance with a legal obligation (e.g. tax/accounting records) — Art. 6(1)(c) | When you delete your account we cancel every subscription, remove your saved payment methods, and erase the name, address, and phone number on your Stripe customer record. That record, with your email address and invoices, is kept for the period tax and accounting law requires. |
| Website analytics — understanding aggregate website usage | Cookieless, aggregated metrics only; no individual tracking or fingerprinting | Legitimate interests — Art. 6(1)(f); no consent required as no personal data is stored on your device | Aggregated; not tied to an identifiable person |
| Contact form — answering messages sent through the website contact form | Name, email address, message, and a keyed (HMAC) hash of your IP address — not the IP address itself. Your name, email address, and message are also delivered by email, through Resend, to our support inbox. | Legitimate interests — Art. 6(1)(f) (answering your enquiry); where it concerns your contract with us, performance of a contract — Art. 6(1)(b) | Deleted automatically 365 days after submission; earlier if you delete your account and the message was sent from your account's verified email address. The copy in our support inbox is kept until your request is resolved and then deleted. |
| In-app feedback — handling feedback and bug reports sent from the desktop app | Reply email address, feedback category, message, and a keyed (HMAC) hash of your IP address. The reply email address, category, and message are also delivered by email, through Resend, to our support inbox; that email also includes your account ID. | Legitimate interests — Art. 6(1)(f) (supporting you and improving the app) | Deleted automatically 365 days after submission, or when you delete your account. The copy in our support inbox is kept until your request is resolved and then deleted. |
| Diagnostic reports — investigating a problem you report (desktop app; only when you choose to attach one to feedback) | The feedback details above, linked to your account ID, plus a redacted report: app version, OS/runtime details, a log excerpt, and recent in-app activity. File paths in your home folder are reduced to file names, and email addresses and access tokens are removed. Never includes file contents or repository content. | Consent — Art. 6(1)(a); given by attaching the report, and you can ask us to delete it at any time | Deleted automatically 14 days after submission, or when you delete your account |
| Abuse prevention — protecting forms and sign-in from automated abuse | Your IP address is checked by Cloudflare Turnstile when you submit a protected form; a hash of your IP address (or IPv6 network) is used as a short-lived rate-limit counter | Legitimate interests — Art. 6(1)(f) (keeping the service secure) | Rate-limit counters expire automatically after at most 24 hours |
| Crash & error diagnostics — diagnosing app crashes and errors to fix bugs (desktop app; strictly optional, off by default) | Error and stack-trace details, app version, OS/runtime context, and a random installation ID — only if you turn diagnostics on. Never includes repository content. | Consent — Art. 6(1)(a); you can withdraw it at any time in the app's settings | Retained only as long as needed to investigate the issue, then deleted |
Providing your email is necessary to create an account and use the paid service; without it we cannot provide the contracted service. We do not carry out automated decision-making or profiling that produces legal or similarly significant effects.
Who processes your data (processors & sub-processors)
We share data only with the service providers below, who act as processors on our instructions. We do not sell, rent, or monetise your data.
- Supabase (EU region) — hosts our database and authentication; stores account, authentication, and billing-related data.
- Stripe — processes payments and manages subscriptions and invoicing.
- Cloudflare — provides website hosting, content delivery (CDN), and security, including the Turnstile CAPTCHA that protects our forms from automated abuse.
- Plausible — provides cookieless, privacy-friendly website analytics with no individual tracking (EU-hosted).
- Resend — delivers transactional email (e.g. sign-in and account-related messages) and forwards contact-form and in-app feedback messages to our support inbox.
- Sentry — receives crash and error diagnostics only if you opt in to diagnostics in the desktop app. They are pseudonymous, not anonymous: each report carries a random installation ID, so reports from the same installation can be linked, but not your name, email, or account.
If you choose to sign in with GitHub, Google,GitLab, or Apple, that provider authenticates you under its own privacy policy and acts as an independent controller for the sign-in it performs; it shares with us only the account details described above.
International transfers
We aim to keep personal data within the European Economic Area (EEA); for example, our Supabase database is hosted in an EU region and our website analytics (Plausible) are EU-hosted. Some processors are based in the United States and may process limited data outside the EEA. Where that happens, the transfer is protected by an appropriate safeguard under Chapter V GDPR:
- Stripe, Cloudflare, Resend, and Sentry are certified under the EU–US Data Privacy Framework, and additionally rely on the European Commission's Standard Contractual Clauses (SCCs).
- Supabase relies on the Standard Contractual Clauses (SCCs), with our database region set within the EU.
You can request a copy of the relevant safeguards by emailingprivacy@wyrmflow.com.
Your rights
Under the GDPR you have the right to:
- Access — obtain a copy of the personal data we hold about you.
- Rectification — have inaccurate or incomplete data corrected.
- Erasure — have your data deleted ("right to be forgotten").
- Restriction — ask us to limit how we process your data.
- Data portability — receive your data in a structured, machine-readable format.
- Objection — object to processing based on legitimate interests.
- Withdraw consent — where processing is based on consent, withdraw it at any time (this does not affect processing already carried out).
You can delete your account and its associated data at any time from your account settings. To exercise any other right, email privacy@wyrmflow.com. We will respond within the time limits set by the GDPR.
Right to complain
If you believe we have mishandled your data, you have the right to lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), or with the supervisory authority in your EU country of residence.
Cookies
We use only strictly-necessary cookies, so no consent is needed for them: the Supabase session cookies that keep you signed in to the account area, and, while you sign in, short-lived cookies that hold the email address you are verifying (15 minutes), a pending sign-in hand-off to the desktop app (10 minutes), and the OAuth PKCE verifier for the provider you chose. Our contact form is protected by Cloudflare Turnstile, which may store a short-lived, strictly-necessary token solely to verify that a submission is not automated. Our website analytics (Plausible) are cookieless and store no information on your device, so we do not show a cookie consent banner. We do not use advertising or third-party tracking cookies.