Privacy Policy

01Who we are

darkship is a feature flag service operated by Rock Application Systems, LLC (“Rock Application Systems, LLC”, “we”, “us”), a limited liability company incorporated in Delaware, United States. This policy explains how we handle personal data when you visit our website, create an account, use the console, the REST API and the SDKs, or contact us.

Company registration: Delaware limited liability company, file number 10478325. Registered address: 131 Continental Dr, Suite 305, Newark, Delaware 19713, United States.

Our Data Protection Officer (encarregado) can be reached at dpo@darkship.tech.

02Our role: controller and operator

We act in two different roles, and the rules differ between them.

• Controller (LGPD “controlador”; GDPR “controller”) for the personal data of people who visit our website, hold an account, or contact us: account and login data, billing contacts, security and audit records, support requests.
• Operator (LGPD “operador”; GDPR “processor”) for anything your organisation puts into the Service about your own users, such as identifiers in targeting lists or segments. For that data, you decide why and how it is processed, and we process it only on your instructions, under the terms of the Data Processing Agreement.

03Data we collect

You provide most of this data directly. Some is generated when you use the Service (logs, usage counters), and, if you use Google sign-in, some comes from Google.

04Data we do not collect

We do not store the evaluation context of your end users. When your application evaluates a flag, attributes such as a user key, email, country, plan or any custom attribute are matched against your rules inside your own process by the server SDKs. For remote evaluation (client-side SDKs and the evaluation API), the context is held in memory for that single request and discarded. It is not written to a database, a log or an error report. Telemetry is limited to aggregate counters per flag and variation, with no user identifiers.

What you choose to store. Flag keys, names, descriptions and rule values are your business data. Please do not place personal data in them. If you use targeting lists or segments that contain identifiers of your own users (for example user ids or email addresses), you are the controller of that data and we process it as your operator. Prefer opaque identifiers over email addresses where you can.

We do not sell personal data, we do not use it for advertising, and we do not build profiles of your end users.

05How we use data

• To provide, secure and support the Service, including authentication, invitations, audit logs, webhooks and the evaluation service.
• To bill you, apply plan limits and warn you about quotas, payment problems, incidents and changes to our terms.
• To prevent abuse, fraud and unauthorised access (rate limiting, brute-force protection, audit records).
• To diagnose errors and improve reliability and performance, using aggregate and anonymised information wherever possible.
• To comply with legal obligations and to establish, exercise or defend legal claims.

We send service emails (verification, password reset, invitations, security, billing and quota notices). These are part of the Service, not marketing. We do not send marketing email unless you ask for it, and every such message will include a way to opt out.

06Sub-processors and recipients

We share personal data only with the providers below, who process it on our behalf or, in the case of Google, as the identity provider you choose. We choose providers that offer appropriate security and data protection commitments, and we require them to protect the data.

We may also disclose data when required by law, court order or a competent authority, to protect rights, safety and the security of the Service, or in connection with a merger, acquisition or sale of assets (we would tell you and the recipient would remain bound by this policy). We will update this table before adding a new sub-processor that handles personal data and, where you have a Data Processing Agreement with us, give notice as that agreement provides.

07Retention

• Account and organisation data is kept while your account or organisation exists, and erased as described in the next section.
• Application logs and error reports are kept for up to 30 days on all plans and do not contain evaluation context.
• Backups are kept for no more than 30 days. Data you delete remains in backups until they expire, and if a backup is ever restored we re-apply pending deletions before the data is used.
• Billing and tax records are kept for as long as tax and accounting law requires, even after account closure.
• Support correspondence is kept while it is needed to help you and for a reasonable period afterwards.
• Retention is enforced by a daily job. If you move to a plan with a shorter window, older records are removed at the next run, and the console warns you before data becomes unavailable. You can export your audit log (CSV or JSON) from the console and the API at any time.

08Deleting your account or organisation

• Your own account. You can delete your account and request an export of your personal data from the console security settings. If you are the only Owner of an organisation you must first transfer ownership or delete the organisation. Audit entries you created are kept, with your name and email replaced by a pseudonym, so that your organisation’s history stays intact.
• An organisation. An Owner can delete the organisation after re-authenticating. It then enters a 30-day regret period. During this period the console is read-only, the paid subscription is set to end at the close of the current billing period, and Owners get reminders and can cancel the deletion with one action. To avoid breaking your applications without warning, SDK keys keep serving flags until the deletion date. After 30 days a background job permanently erases all data belonging to the organisation, including cached flag snapshots, and removes the Stripe customer where the law allows. We keep a minimal deletion ledger (hashed organisation identifier and timestamps, no content) as evidence that the erasure happened.
• Copies in backups expire within the backup window above. Records we must keep by law, such as invoices, are retained for the statutory period and then erased.

09International transfers

Rock Application Systems, LLC is established in the United States, our servers are in Germany, and some of our providers (Stripe, Google, Cloudflare) operate globally. Your data may therefore be processed outside your country, including outside Brazil, the European Economic Area and the United Kingdom. Where this happens we rely on a transfer mechanism recognised by LGPD art. 33, and by GDPR chapter V where it applies, such as adequacy decisions, standard contractual clauses or the provider’s data protection certifications, together with contractual and technical safeguards. You can ask us for details at dpo@darkship.tech.

10Your rights

Under the Brazilian General Data Protection Law (LGPD), and under the GDPR if you are in the European Economic Area or the United Kingdom, you can ask us to:

• confirm that we process your data and give you access to it;
• correct incomplete, inaccurate or outdated data;
• anonymise, block or delete data that is unnecessary, excessive or processed unlawfully, and delete data processed on the basis of consent;
• give you your data in a portable format;
• tell you with whom we have shared it;
• explain the consequences of refusing consent, and withdraw consent at any time (withdrawing does not affect earlier processing);
• object to processing based on legitimate interest, and review decisions made solely by automated means (we do not take such decisions about you).

Many of these you can do yourself in the console: edit your profile, change your password and two-factor settings, end sessions, export your audit log, request a personal-data export and delete your account. For anything else, write to dpo@darkship.tech. We may need to verify your identity, and we aim to reply within 15 days. If you are an end user of one of our customers, please contact that customer first, since they decide how your data is used; we will help them respond.

If you live in a US state with a consumer privacy law (for example California), you may also have the rights to know, access, correct, delete and port your personal information and to opt out of its sale or sharing for targeted advertising. We do not sell personal information and we do not share it for cross-context behavioural advertising, and we will not discriminate against you for exercising these rights. Use the contact address below to make a request.

You also have the right to lodge a complaint with the Brazilian data protection authority (ANPD) or, in the EEA or UK, with your local supervisory authority.

11Cookies and local storage

The console uses only strictly necessary storage and needs no banner. On the website, analytics never loads unless you accept it, and you can change your mind at any time.

Cookie settings

12Security

• All traffic to our hosts uses TLS.
• Passwords are stored only as salted hashes. Two-factor authentication (TOTP) and recovery codes are available to every account.
• SDK keys and API tokens are shown once and stored only as hashes. Keys can be rotated with an overlap window and revoked immediately.
• Customer data is isolated by organisation at the database level (row-level security), not only in application code. Roles and scoped API tokens limit what each member and integration can do, and changes are written to an audit log.
• Webhook signing secrets and other stored secrets are encrypted. The evaluation service uses least-privilege access to its cache and database.
• Our own staff access to customer data is limited to what support and operations need, goes through a separate, access-controlled admin tool, and is logged, with a second approval for destructive actions.
• Error reports are scrubbed of cookies, authorization headers, request bodies and email addresses before they leave the service.

No system is perfectly secure. You can help by keeping your credentials and server keys private (never ship a server key to a browser or mobile app), enabling two-factor authentication and removing members who no longer need access. To report a vulnerability, write to security@darkship.tech.

13Security incidents

If a security incident affects personal data and is likely to cause relevant risk or damage, we will notify the affected customers, and the ANPD or other authorities where the law requires, without undue delay and with the information the law and the Data Processing Agreement call for. Incidents that affect availability are published on our status page.

14Children

The Service is for businesses and developers and is not directed to children. You must be at least 18 years old to create an account. If we learn that we hold an account belonging to a child, we will delete it.

15Data Processing Agreement

If you are a customer and you put personal data of your own users into the Service, or your compliance team needs a data processing agreement, email dpo@darkship.tech and we will send you our standard Data Processing Agreement. It covers instructions, confidentiality, sub-processors, security measures, assistance with data subject requests, incident notification, audits, international transfers and deletion at the end of the contract.

16Changes to this policy

We may update this policy as the Service or the law changes. The version and effective date are at the top of this page. For material changes we will notify organisation Owners by email at least 30 days before they take effect, and we keep earlier versions available on request.

17Contact

Privacy and data protection: dpo@darkship.tech. Legal notices: legal@darkship.tech. Security: security@darkship.tech. See also our Terms of Service.