Privacy Policy
Last updated: 3 October 2026
1. Information We Collect
When you use dkod, we collect information you provide directly, such as your email address when joining early access, and usage data generated through your interaction with our services.
- Account information (email, name, company)
- Standard web server logs kept by our hosting provider (IP address, requested page, browser type, time)
- Device reports produced by dkod-signals, when your organisation uploads them to the dkod dashboard. A report is metrics-only: it carries account usernames and full names, application names and owners, hashed device identifiers, risk scores, and counts — never source code, file contents, secret values, file paths, URLs, email addresses, commit messages, or prompts. The complete field list is available on request from privacy@dkod.ai.
- Device and browser information
Our join form also asks about your company setup, such as your cloud provider, identity provider and device-management tool. We use these answers only to prepare the first conversation with you. We do not sell them and we do not use them to profile your organisation.
The local trial form collects your company, first and last name, title, and work email so we can send your download instructions through our email provider, Resend. We store that submission and its send status. Requesting this email does not subscribe you to marketing emails. Your local trial scan report is not sent to dkod or Resend.
2. How We Use Your Information
We use collected information to:
- Provide, maintain, and improve our services
- Send you updates about dkod (you can opt out at any time)
- Respond to your requests and support inquiries
- Analyze usage patterns to improve the platform
- Detect, prevent, and address security issues
3. Device Reports & Data Security
The dkod-signals scanner runs on your organisation's devices and produces a metrics-only report. Mirroring that report to an S3-compatible storage bucket is optional and uses credentials your organisation configures for its own cloud account. Dashboard upload is opt-in: with uploading on, an additional copy goes to the dashboard for your organisation. These are the scanner's only network destinations. The scanner reads source files on the device to classify them, but none of what it reads leaves the device: we never receive, store, or train on source code. Reports are encrypted in transit. Dashboard sign-in email addresses are stored as one-way hashes, never as the address itself.
The personal trial saves a JSON report and an HTML dashboard on your device. It does not upload or mirror the report. Its browser viewer listens only on your device's loopback address and stops when you close it with Ctrl+C. The saved HTML can also be opened offline. Downloading or updating the scanner connects to GitHub to fetch the public release; it does not send your scan results.
4. Data Sharing
We do not sell your personal information. We may share data with trusted third-party service providers who assist in operating our platform, subject to confidentiality agreements. We may disclose information when required by law.
6. Data Retention
We retain your account information for as long as your account is active. Early-access signup data is retained until you request removal or gain access to the platform. Trial signup data is retained until you request removal. You control deletion of reports saved on your device. Device reports uploaded to the dashboard are retained under your organisation's own controls. You may request deletion of your data at any time by contacting us at privacy@dkod.ai.
7. Your Rights
You have the right to:
- Access the personal data we hold about you
- Request correction of inaccurate data
- Request deletion of your data
- Opt out of marketing communications
- Export your data in a portable format
8. Contact
For privacy-related inquiries, contact us at privacy@dkod.ai.