Privacy policy
What DesignDoc collects, why, who else sees it and how to get it deleted. Written to match what the code does today.
Last updated
The short version
- We collect what it takes to run DesignDoc: your account, your workspace's content and the integrations you connect.
- No advertising, no third-party analytics or trackers, no selling of data.
- Our API and database run on a server in India. The website is hosted on Vercel.
- AI features send decision content to an AI provider, only when used. Admins can turn AI off.
- Email hello@designdoc.tech to get a copy of your data or have it deleted.
What we collect
Your account
When you sign in we store your email address, name, a link to your profile picture (we don't currently display it), whether an identity provider has verified your email, and the id of each sign-in you use: GitHub (with your GitHub username), Google or Auth0. With GitHub we read your public profile and verified email once, during sign-in; we do not keep the GitHub access token. With Google we ask only for openid email profile.
Your workspace
Everything you and your teammates put into a workspace: decisions and every saved version, status changes, comments, review requests and verdicts, links to code, pull requests and tickets, templates, and the in-app notifications these produce. Members and their roles are stored with the workspace. If someone makes a decision public, anyone with its link can read it.
We do not host uploaded files. An image in a decision is a link to wherever it lives; when the page shows it, our image proxy at /api/imgfetches it so the image host never sees readers' IP addresses. Vercel may cache the image for up to a day.
Keys and integrations
- API keys are shown once. We keep a SHA-256 hash (bcrypt for older keys), a short prefix, the name you gave it and when it was last used.
- GitHub: the App installation (account name, installation id, which repositories it can see), each connected repository (owner, name, branch, ADR folder), the ADR files we import, and for drift detection the commit ids, changed file paths and pull request numbers of pushes that touch linked code. Personal access tokens are encrypted.
- Slack: the incoming-webhook address, encrypted, plus a short hint so you can recognise it.
- Billing, when a workspace pays: the Razorpay subscription id, plan, seat count, status and dates, and the webhook events Razorpay sends us, which may include the payer's email address or phone number. You type card details into Razorpay's checkout, which opens in an iframe; they never reach DesignDoc.
Without an account
The free reviewer at /review sends your text to our managed AI provider (see AI features) and returns the findings. We store neither the text nor anything about you, only a count of reviews per day; the provider's own retention is outside our control, so don't paste anything confidential. The sandbox reads ADRs from a folder on your computer or a public GitHub repository, entirely in your browser; nothing is uploaded to us. For a repository, your browser fetches the files directly from GitHub (api.github.com and raw.githubusercontent.com), so GitHub sees your IP address and which repository you opened.
IP addresses and logs
- When you ask for an email sign-in link, we store your IP address with it to limit how many links one address can request. The link works for 15 minutes; the record, IP address included, is deleted about a day after the link is requested, once it no longer counts towards the daily limits.
- Other rate limits (the free reviewer, image signing, sign-in attempts) count requests per IP address in server memory only. Those counters are never written to the database and reset when the server restarts.
- Our API's request logs record method, path, status, size, duration and a request id; we don't log IP addresses on normal requests. Logs rotate by size and are overwritten after a limited period.
- Vercel, as our host, processes IP addresses and request logs under its own policy.
AI features
AI pre-review, Ask, checklists and drift summaries send content to an AI provider: the decision text, related decisions and, for drift summaries, short excerpts of the code changes in linked files. We send it only when you or your workspace use these features. AI results are stored with the decision.
By default we use our managed provider, which currently routes requests to Google Gemini models through a router on our own server. Those are free-tier model services whose retention and use terms we don't control. Workspace admins can avoid that by bringing their own Anthropic or Google Gemini key, which we store encrypted, so requests go to that provider under your account and terms, or by turning AI off for the workspace. We do not train models on your content and do not sell it.
How long we keep it
| Data | Why | How long |
|---|---|---|
| Account: email, name, profile picture link, GitHub, Google and Auth0 account ids, GitHub username, whether your email is verified | Signing you in, showing who wrote what, notifications | Until your account is deleted |
| Workspace content: decisions and their versions, comments, reviews, links, templates, notifications, AI findings | Providing the service | Until you delete it or the workspace is deleted |
| Email sign-in links (only a SHA-256 hash of the token), with your address and IP address | Signing you in, limiting abuse | Deleted about a day after the link is requested |
| Campaign values saved when you sign up | Knowing which channels bring people to DesignDoc | 13 months |
| GitHub webhook delivery records | Processing each delivery once | 30 days |
| Finished GitHub sync jobs | Retries and troubleshooting | 14 days |
| AI usage records: feature, model, token counts and cost, no content | Plan limits and cost control | While the workspace exists |
| Billing: Razorpay subscription id, plan, seat count, status and the webhook events Razorpay sends us (may include the payer's email or phone) | Charging the right amount, showing billing history | While the workspace exists |
Export and deletion
You can delete your own decisions and comments, revoke API keys, disconnect repositories and remove a bring-your-own AI key in the app. Deleting a decision also deletes its versions, comments, reviews, links and AI results. Admins can remove members.
Deleting a whole account or workspace is not self-serve yet. Email hello@designdoc.tech from your account's address and we will do it. When a workspace is deleted, its decisions, comments, integrations and billing records go with it. When your account is deleted, your profile, memberships, notifications and campaign values are removed. Decisions and comments you wrote in a shared workspace belong to that workspace: its admins and owners can delete decisions (which removes their comments too), and you can delete your own comments. For anything else, contact us.
To take your decisions with you, export them as Markdown ADR files to a GitHub repository, read them through the API, CLI or MCP server, or ask us for an export.
Your rights
Wherever you live, you can ask us to tell you what we hold about you, give you a copy, correct it, delete it, or stop a particular use of it. If you are in India, these are your rights as a data principal under the Digital Personal Data Protection Act, 2023, including the right to nominate someone to act for you and to have a grievance answered. If you are in the EU or UK, you also have the GDPR rights of portability and objection, and may complain to your data protection authority.
Email hello@designdoc.tech. We may ask you to confirm the request from your account's address, and we answer within 30 days. Where a workspace administrator controls the content (for example, decisions your employer's workspace holds), we may refer you to them.
Security
- Connections to designdoc.tech use HTTPS.
- Secrets you give us (bring-your-own AI keys, GitHub tokens, Slack webhook addresses) are encrypted with AES-256-GCM. API keys and sign-in link tokens are stored only as hashes.
- Session cookies are signed, HttpOnly and expire after 7 days.
- Apart from decisions someone has made public, every request for workspace data checks that you are a member; other workspaces' data answers as not found.
No system is perfectly secure. We hold no security certification. If you find a vulnerability, email hello@designdoc.tech.
Children
DesignDoc is a tool for engineering teams and is not directed at anyone under 18. We do not knowingly collect data from children; if you believe a child has given us data, email us and we will delete it.
Changes and contact
When this policy changes we update the date at the top, and for material changes we tell signed-in users in the app or by email before they take effect. DesignDoc is run from India. Questions, requests and grievances: hello@designdoc.tech.