Privacy Policy

1. Information We Collect

When you use Ceraph, we collect information necessary to provide the service:

• Account information from GitHub, Google, or email sign-in, including your name, email, profile image, provider account identifiers, and authentication data such as provider tokens and permissions
• Your subscription tier, checked against your authentication token to unlock Pro features
• When you register a development installation with your account, its computer name, operating system, registration identifiers, public key, and last-used time
• Pending Pro seat invitations and seat assignments, including the invited email address and the account providing access
• Payment information (processed by Stripe — we never see or store card numbers)
• Your name, email, optional company, and message when you contact us
• Technical request information, including IP addresses, browser information, and error or security records, to operate and protect the service
• Website traffic measurements provided by Cloudflare Web Analytics, including visits and page views, visited pages, referring sites, browser and device information, approximate country, and performance. This measurement does not use analytics cookies or persistent visitor identifiers. Cloudflare processes these measurements; we read aggregate reports without copying individual website events into our database. Browser blockers may prevent collection. Cloudflare does not log query strings for Web Analytics.
• Sign-in and checkout diagnostics: short-lived random journey references, authentication provider, completed stages, times, and predefined failure categories. Completed sign-ins can be associated with your account to diagnose problems. These records do not contain passwords, authentication tokens, payment details, or the contents of forms. Diagnostic records are retained for up to 180 days.
• Minimal CLI/MCP installation analytics: daily activity with a random installation identifier, running and installed versions, host operating system, and whether initialization and app bring-up have ever succeeded. Limited setup, start, and remote-connection diagnostics record outcomes, CLI or MCP entry point, version, host architecture, platform and target class, setup stages and their check results, predefined failure categories, event times, elapsed-time ranges, and delivery-loss counts. Older package versions also report daily attempt and success counts. Setup checkpoints record which type of decision was reached, never prompt text or your answers. Random operation identifiers associate the start and completion of an invocation, including automatic setup within a start request; they do not identify projects. Successful explicit project removals are recorded separately without identifying the project. Signed-in reports are linked to your Ceraph account. The installation identifier also lets us connect earlier reports from that installation to its later signed-in activity, including for support.
• Hosted connection diagnostics: account-linked outcomes for authorization, access renewal, MCP initialization, and tool discovery, with event times and predefined failure categories. We retain bounded state changes for 30 days, not individual testing actions or tool contents. For hosted diagnostics, we honor Do Not Track and Global Privacy Control signals on requests that include them; browser signals do not automatically apply to separate MCP-client requests. CLI analytics preferences apply only on the computer where they are saved.

2. How We Use Your Information

We use collected information to:

• Authenticate you and verify your subscription tier to unlock Pro features
• Manage your subscription and billing
• Send Pro seat invitations and manage access purchased for other users
• Understand product adoption, version uptake, and whether setup and app bring-up are succeeding
• Respond to support requests, diagnose problems, and protect against abuse

Agentic flow testing itself runs locally: the package drives your app on your own device or simulator and delivers the results to your coding agent. Your app binary, test credentials and data, camera media, recordings, screenshots, and structured UI snapshots are not uploaded to our servers as part of local testing. Results sent to your chosen AI client may be processed remotely under that provider's policies.

If you enable a remote connection, Ceraph relays the tool inputs and requested app content between your computer and your chosen AI client. This can include UI text, screenshots, recordings, media fixtures, and information returned by your test hooks. Remote access requires your local approval; stop the connection to end access. This does not change how local-only testing works.

3. Data Storage and Security

Ceraph builds, runs, and drives your app locally on your own device or simulator. The current MCP package does not upload project source to Ceraph for server-assisted planning. Our servers hold your account information, subscription and billing status, pending Pro seat invitations and assignments, and the authentication token that links them.

Project-owned test hooks, media fixtures, and recorded-run evidence live under your project's local .ceraph/ directory. Videos, structured UI snapshots, screenshots, and redacted manifests are written to the ignored .ceraph/recorded-runs/ workspace. Before a new run starts, Ceraph attempts local cleanup of generated runs older than seven days. Evidence can be supplied to your coding agent through the MCP.

Installation analytics do not contain repository names, filesystem paths, source code, tool histories, test-device identifiers, or test evidence. IP addresses are processed for abuse prevention but are not stored raw in installation analytics tables.

Sign-in uses essential cookies. Website traffic measurement does not respond to browser Do Not Track signals; the package honors DO_NOT_TRACK=1 and its analytics preferences.

4. Third-Party Services

We use the following third-party services to operate Ceraph:

• GitHub, Google — OAuth sign-in; GitHub also hosts approved public issue reports
• Stripe — payment processing and subscription management
• Neon — database hosting
• Vercel — website and API hosting
• Resend — transactional and magic-link email delivery
• Cloudflare — website traffic measurement, buffered installation, sign-in, checkout, and remote-connection diagnostics storage, and remote connection hosting
• Upstash — background job delivery
• npm — package delivery and update checks

5. Data Retention

We retain your account information and active Pro seat assignments for as long as your account is active. Pending invitation data is cleared on acceptance or revocation; expired invitations are cleared during subsequent access or scheduled cleanup. You can delete your account from Settings or by contacting us. Stripe may retain transaction records as required for payment processing, tax, fraud prevention, and legal compliance. A limited billing-cleanup record may remain after account deletion, with a 35-day expiry and subsequent routine cleanup. Contact correspondence is retained for support without an automatic deletion period; you can request deletion.

Any source files, app configuration, paths, or repository metadata retained from legacy server-assisted features become eligible for deletion after 30 days without use. Their cleanup depends on legacy feature activity, so eligible data may remain until cleanup runs or you request deletion. Local copies of app bundles, test credentials and data, camera media, screenshots, recordings, and structured UI snapshots remain on your machine — under your project's .ceraph/ directory and Ceraph's local ~/.ceraph/ directory — and are yours to keep or delete.

If you previously connected a legacy chat integration, associated chat-account identifiers and tokens may remain with your account. Contact us to remove those records.

Remote account connections and remembered computers expire after 30 days of inactivity or earlier revocation. We retain connection identifiers, public keys, authorization records, and hashed token receipts to authenticate requests and enforce revocation. Token receipts become eligible for cleanup within 31 days of issuance or verified use. Local access sessions last at most eight hours; their operation-status records expire with the session. Tool results are held temporarily for delivery and become eligible for cleanup within 32 minutes, generally within two minutes of completion. Generated recording files remain on your computer and are relayed when requested. Your AI provider's retention policies apply to content it receives. Remembered computer keys remain on your computer until replaced or removed; use ceraph connect --forget --profile general or ceraph connect --forget --profile openai to revoke that pairing.

Project removal events, daily installation samples, and aggregate reliability counts are retained for up to 180 days before scheduled cleanup. Detailed setup, start, and remote-connection diagnostics are retained for 30 days; limited deduplication records remain with the aggregates. Reports awaiting import may remain in our Cloudflare buffer during an outage, then are imported or discarded according to these reporting periods. Buffered delivery and quota records become eligible for cleanup after 31 days. Inactive abuse-control counters become eligible after one hour, but records associated with pending reports can remain until processing completes. After installation analytics deletion, a non-usage suppression marker remains for at least 31 days, and until pending buffered cleanup completes, to reject late in-flight samples.

Cloudflare provides unsampled website measurements for seven days and longer-term reports for up to six months. Its retention practices are described in its Web Analytics documentation.

6. Your Rights

You can:

• Review your connected accounts and subscription in Settings
• Delete your account from Settings or by contacting us
• Request a copy of your stored data by emailing us
• Opt out of non-essential communications at any time
• Turn installation analytics on or off with ceraph analytics on or ceraph analytics off. Turning collection off does not delete retained activity. ceraph analytics --delete deletes retained analytics for the installation identifier stored on this computer and turns collection off. Account deletion alone may leave installation activity without an account association; use the analytics deletion command or contact us to remove it

Depending on your location, you may also have rights to correct, restrict, or object to processing, request portability, or complain to a data protection authority. Contact us to exercise applicable rights.

GitHub defect reports are public and use your GitHub account. Ceraph requires approval for each report unless you explicitly authorize future sanitized reports for that account. Reporting is optional, includes no automatic source or evidence attachments, and can be disabled in Ceraph preferences. Public reports already submitted are subject to GitHub's retention and deletion controls.

7. Contact

For privacy-related questions, contact us at privacy@ceraph.dev.