1 Who we are
Heddle ("we", "us", "our"), a business in the United States, operates the heddle.sh website and the Heddle version control service, where people and agents propose, review and land changes to code. This policy describes how we collect, use, and protect your information.
2 Information we collect
Information you provide
- Account information. Your handle, the display name you choose, and your email address. We also keep the public keys of your passkeys and devices. If you sign in with a password, we keep an encrypted copy of your account key that only your password unlocks; we never receive the password itself.
- Spool data. The code, history, threads, reviews, discussions and context you and your agents store in Heddle, and the attribution on each change: which account made it and, for agent work, which agent and model.
- Imported repositories. When you import a Git repository, we copy its branches and history into a spool. That history includes the names and email addresses of the people who made its commits.
- GitHub. If you sign in with GitHub, we read your GitHub profile and email addresses and keep an encrypted copy of the access token GitHub gives us. If you install the Heddle GitHub App to import repositories, we record the GitHub account it is installed on and the repositories it can see.
- Billing information. Your plan, subscription status and billing history. Card details go to our payment provider, Polar, and never reach us.
- Handle reservations and invitations. The name, email address and handle you give when you reserve a handle, and the email addresses of people you invite. If you join with someone’s invitation, we record who invited you.
- Communications. Messages you send us via email or support channels.
Information collected automatically
- Request and security data. Your IP address, browser user agent and the addresses you request pass through our hosting providers and appear in their logs. We keep the user agent of each signed-in session. We record IP addresses and email addresses to limit abuse of the handle reservation form, and we log an IP address when it is refused for making too many requests.
- Analytics, when it is on (see Cookies and browser storage). Pages viewed, links and buttons clicked on our public pages with their text, how far you scroll, the referring page and campaign tags, screen size, browser user agent, and your country. In the app we record which screen you are on, with spool, file and change names removed, and how long pages take to load. A few in-app events are tied to your account.
- Email delivery. Whether each email we send you was delivered, bounced or marked as spam. We don’t record whether an email is opened or which of its links you click.
3 How we use your information
- Provide, maintain, and improve the Heddle service.
- Authenticate users and enforce access controls.
- Bill for paid plans and storage, and apply invitation rewards.
- Respond to support requests and communicate service updates.
- Detect and prevent abuse, fraud, and security incidents.
- Generate aggregated analytics to improve the product.
If you are in the EU, EEA, UK or Switzerland, the law asks us to say what allows each use:
- Running your account and the service, and the emails it needs to send: our contract with you.
- Billing, and keeping billing records: our contract with you, and the law, which requires financial records.
- Limiting abuse and keeping the service secure: our legitimate interest in keeping Heddle available and safe.
- Analytics: your consent, which you can withdraw at any time in Cookies and browser storage.
- Answering lawful requests: a legal obligation.
We do not send your code to AI model providers. The agent and model names on a change are attribution your tools report, not a sign that we ran a model on your code.
4 Data storage and security
Your repository data is content-addressed and stored with cryptographic integrity guarantees. Data is encrypted in transit over HTTPS and stored with providers that encrypt it at rest. Spool content is not end-to-end encrypted, so the people who run the service are technically able to read it.
We do not look at the content of a private spool unless its administrators grant Heddle support access to it. That access can read or change the spool, ends within seven days, and the spool’s administrators can see it and take it back at any time in the spool’s settings.
6 Data retention
We retain your account data for as long as your account is active.
Deleting a spool removes it for everyone straight away. Stored content is shared between identical files, so copies of a deleted spool’s content can remain in our storage after it is gone from Heddle.
Deleting your account deletes its spools and their stored content, ends every session and device, and releases its handle. We keep billing records, and Polar keeps your customer record, for financial and legal purposes. To delete your account, email privacy@heddle.sh.
If an account holds more than the Free plan’s storage with no paid plan, its spools and their content are deleted 120 days after it last had one.
Cloudflare keeps our website’s logs for up to 7 days.
We delete the records we keep to limit abuse, which hold IP and email addresses, after a day; a handle reservation you haven’t confirmed after 7 days; the text of an email we sent you after 30 days; and the record that we sent it, with its delivery events, after a year. If you unsubscribe, or an email to you bounces, we keep that so we don’t email you again.
Analytics events are deleted after 3 months. We keep billing records for as long as tax law requires, generally seven years. A confirmed handle reservation is kept until the handle is claimed or you ask us to remove it.
We have not yet set a retention period for records of past sign-in sessions; we keep them until you ask us to delete them. You may request deletion of your personal data by contacting us at privacy@heddle.sh.
7 Your rights
Depending on your jurisdiction, you may have the right to access, correct, delete, or port your personal data. You may also object to or restrict certain processing. To exercise these rights, contact privacy@heddle.sh.
If you are in the EU, EEA, UK or Switzerland, you can also complain to a data protection authority, such as the one where you live or work. We would appreciate the chance to put it right first, at privacy@heddle.sh.
You can change your display name in Settings, and download your spools with the Heddle command line tool. For a spool imported from another Git host, only the latest version of its files can be downloaded today, not its earlier history.
9 Children
Heddle is not directed at children under 16. We do not knowingly collect personal data from children.
10 Changes to this policy
We may update this policy from time to time. Material changes will be communicated via email or a notice on the site. Continued use of the service after changes constitutes acceptance.
11 Contact
Questions about this policy: privacy@heddle.sh