Privacy policy
Last updated: 4 November 2026
This policy explains what ALIGN (the "service") collects, why, where it goes and how you control it. The service is provided by Sakuraj Technologies Private Limited ("we", "us"). For the data your organisation puts into the service, we act as a processor on your organisation's behalf under our data processing terms; for account, billing and website data, we are the controller.
The short version
- Capture happens only in repositories your organisation connected and you opted into.
- Secrets are redacted on your laptop before anything leaves it. Capture never sends your files' contents (text you paste without a code fence is sent after secret redaction).
- Teammates never read your raw transcripts; they see only short quotes that support a decision someone confirmed.
- You can see everything kept about you, and delete it.
- No per-developer productivity metrics, anywhere.
- We do not sell personal data, and we do not use your data to train models.
What we collect
| Data | Source | Purpose | Retention |
|---|---|---|---|
| Account: name, email, GitHub user id and login, avatar URL | sign-in (Identity Platform: GitHub, or an email link) | sign-in, mapping GitHub and Slack identities | while the account exists |
| Sign-in record held by Identity Platform: its user id, email, linked GitHub identity | Identity Platform, at sign-in | signing in | while the account exists |
| Browser sessions: a hashed session token and its sign-in and last-use times | console sign-in | keeping a person signed in; "sign out everywhere" | valid until sign-out or revocation, 14 days without use, or 90 days after sign-in; the record is deleted 30 days later |
| Organisation: name, settings, members, roles | console | tenancy | while the organisation exists |
| Repository metadata: remote URL, root commit hash, default branch, visibility | CLI, GitHub App | identify repositories | while connected |
| Session events: timestamps, harness name and version, branch, head commit, repository-relative paths the agent touched, and a salted hash of the machine's name (the salt stays on the laptop; it tells one person's machines apart) | CLI hooks and transcripts | compile decisions, scope them to code | 90 days unless cited |
| Conversation text (user and agent messages, secrets redacted, fenced code blocks and tool contents replaced by placeholders; text pasted without a code fence is included) | CLI hooks, opt-in backfill | compile decisions; quotes as receipts | 90 days unless cited; deleted with its session |
Text a person or their agent records (align decide, align ask, MCP record_decision, ask_owner) | CLI, local MCP server | the ledger | until the organisation deletes it |
| Commit messages and trailers, changed paths | CLI git hooks, GitHub App | link decisions to code | while the repository is connected |
| Check results: paths and line numbers | worker, CLI | verification | 180 days |
| Slack messages that mention ALIGN or answer its questions | Slack app | answers, receipts | while cited, else 90 days |
| Linear issue title, description, branch name | Linear app | briefs and contracts | while connected |
| Pull-request diffs: the hunks under a decision's scope (and test-file hunks for contracts) | GitHub App | judging conflicts and contract coverage | processed in memory after secret redaction, sent for model processing on Google Cloud's Agent Platform, not stored |
| Ledger exports a person asks for | console, CLI | export | the file behind the download link is deleted after 1 day (storage removes it within 2 days at most) |
| Pilot and terms acceptances: document, version, time | console, CLI | records of consent | while the account exists |
| Billing: plan, seat counts, provider customer and subscription ids | us (invoices), or the billing provider once online checkout opens | billing | per tax law |
| Operational logs, error reports and traces: ids, counts, durations, status codes, error codes and stack traces (no content) | web, worker, jobs; browser errors scrubbed and sampled | reliability | 30 days (Cloud Logging, Error Reporting, Cloud Trace) |
What we never collect
File contents (including what an agent read or wrote through tools), the shell commands tools run and
their output, diffs from your laptop, fenced code blocks, environment variables or .env files, secrets
matching the redaction rules, keystrokes, screen contents, hostnames (only the salted hash
above), OS usernames, IP addresses in event
payloads, paths outside the repository, data from repositories that are not connected and opted in, Slack
channel history, per-person productivity metrics.
How we use it
We use the data above only to provide the service: to sign you in, to compile proposed decisions from your sessions with exact quotes, to check decisions against your code, to serve them back to your agents and your team, to send the emails you or your organisation asked for (sign-in links, invites, the weekly digest), to bill, and to keep the service secure and reliable. We do not use it for advertising, we do not build profiles of individuals, and we do not measure anyone's productivity.
Model processing
Redacted conversation text, redacted pull-request hunks, and the Slack questions and Linear issue text that come from tools your organisation connects (redacted again on our servers) are processed by Google's Gemini models on Google Cloud's Agent Platform to propose decisions and to judge whether a change contradicts one. Under Google Cloud's terms, that data is not used to train Google's models. Every proposal waits for a person to confirm it. We test our prompts on synthetic data and on our own organisation's sessions only; customer data is never used for those tests. If that ever changed, the subprocessor list below would change first.
Who receives it
We share data only with the subprocessors that run the service for us, listed on the subprocessors page, with the tools your organisation connects (GitHub, Slack, Linear), and with the coding agent a member uses when that member asks for entries through it. We disclose data to authorities only when the law requires it, and we tell the affected organisation unless the law forbids it.
| Subprocessor | Role | Region |
|---|---|---|
| Google Cloud | hosting (Cloud Run), database and its backups (Cloud SQL), sign-in (Identity Platform), logs, error reports, traces and uptime checks (Cloud Logging, Error Reporting, Cloud Trace, Cloud Monitoring), key management (Cloud KMS, Secret Manager), export files (Cloud Storage) | United States (us-central1, Iowa) for data at rest |
| Google Cloud Agent Platform: Google's Gemini models | model processing of redacted text and redacted PR hunks; not used for training ("Google won't use your data to train or fine-tune any AI/ML models without your prior permission or instruction"); Google's project-level data caching, which by default keeps inputs, outputs and derived data in memory and on disk for up to 24 hours and is also what implicit context caching uses, is turned off in both our projects, staging and production (disableCache, set in our infrastructure code), so Google keeps no cached copy; request-response logging is off (Google's default) and we create no explicit caches; the one retention left is Google's abuse monitoring: only if its automated classifiers flag a request, Google may log the prompt for up to 90 days in the region or multi-region of the request, solely to check for policy violations, not encrypted with customer-managed keys and never used for training (this applies to customers on Google Cloud's online terms; a Google Cloud Master Agreement exempts it). Sources: Google's "Generative AI and zero data retention", "Context caching overview" and "Abuse monitoring" pages, read 22 Oct 2026 | the global endpoint: a request, and any abuse-monitoring log of it, may be processed in any Google region; we store nothing there |
| Resend | email delivery, including sign-in links | US |
| GitHub, Slack, Linear | the customer's own tools, via the apps they install | per vendor |
| Paddle | merchant of record for orders placed through online checkout, once it opens; until then we invoice paid plans ourselves and no billing provider receives your data | per vendor |
| Anthropic | only two kinds of data, never customer content: (a) evaluation cases for comparing model quality, made from synthetic fixtures and our own organisation's build sessions, sent through Anthropic's API; (b) operational data, because the agents that build and operate the service are Claude Code agents running on Anthropic's service, and they can read our production logs and error reports: ids, counts, durations, status codes, error codes and stack traces, which carry no content. The product's own model calls (compiling decisions, judging pull requests) use only Google's Gemini models on Agent Platform, never Claude; if that ever changes, this list changes first | per vendor |
| The member's own coding agent or connected app (such as Claude.ai or ChatGPT through the remote MCP endpoint) and its model provider | receives entries and quotes the member asks for through the agent tools, only after the member connects it and approves access for one organisation | the member's choice |
The people and the AI coding tools we use to build and operate the service may read operational data (ids, counts, durations, status and error codes), never content: logs and error reports carry no content.
Where it is stored
Data at rest is stored in the United States (Google Cloud us-central1, Iowa). Model requests may be
processed in any Google region; we store nothing there. Where the law requires a transfer mechanism for
data leaving your country, the data processing terms provide it.
How long we keep it
The retention of each kind of data is in the table above. In short: raw session events and conversation text are kept 90 days unless a receipt cites them (a cited line is kept as long as the entry that cites it); operational logs 30 days; check results 180 days; your account while it exists.
Your rights and choices
Developers delete their own sessions at any time (align sessions rm, console): lines, events, quotes
from them and the wording of unconfirmed proposals go immediately. Owners delete the organisation from
settings: a 7-day grace period they can cancel, then deletion completes within 24 hours, and backups and
point-in-time recovery logs age out within 7 more days. Export in open formats at any time. Requests to
privacy@bharatreachdsp.com answered within 7 days. Incidents affecting customer data are notified within 72 hours.
Depending on where you live, you may also have the right to access, correct, restrict or object to our use of your personal data, to receive a copy of it, and to complain to your data protection authority. Ask us at privacy@bharatreachdsp.com and we will answer within 7 days. When your organisation is our customer for that data, we will pass your request to its owners and help them answer it.
Security
The service encrypts data in transit and at rest, keeps connector tokens encrypted with Cloud KMS, checks repository access in the database on every read, and keeps content out of logs. The security page has the details. We notify affected organisations of an incident affecting their data within 72 hours of becoming aware of it.
Cookies
The website sets one cookie when you sign in, to keep you signed in. We use no advertising or analytics cookies.
Children
The service is for professional software teams and is not directed at anyone under 16.
Changes
We will post any change to this policy here with a new date, and email organisation owners at least 14 days before a change that reduces your rights takes effect.
Contact
Sakuraj Technologies Private Limited · privacy@bharatreachdsp.com