Privacy
What we store, and why.
This website
ubrella.dev is a static site served by Cloudflare. Cloudflare processes connection data (IP address, user agent, requested URL) to deliver the site and defend it; we do not receive these logs in identifiable form. Typefaces are served from this domain.
Analytics (PostHog)
We use PostHog, hosted in the EU (Frankfurt), to understand how the site is used and to improve it. Requests go to m.ubrella.dev, a proxy under our control that forwards to PostHog's EU cloud. What is collected:
- Page views and navigation — pages visited, referrer, time on page, screen size, browser and operating system, approximate location derived from your IP (country and city; the IP itself is not stored).
- Interactions — clicks, scrolling and form submissions (autocapture, heatmaps, dead clicks). The content of form fields is never recorded.
- Session replay — a reconstruction of your visit (mouse movement, scrolling, page structure) so we can see where the site is confusing. All input fields are masked; anything marked sensitive is blanked. Replays are kept for 30 days.
- Errors and performance — JavaScript errors and page-load timings.
PostHog sets first-party cookies and local-storage entries on ubrella.dev to recognise a returning browser (a random identifier, no name or email) and to keep a session together. If you join the waitlist, that identifier is linked to your email address so we can see which page convinced you. Retention: event data 7 years or until you ask us to delete it, replays 30 days.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in understanding and improving a small product) for aggregate measurement; consent under § 25 TTDSG / Art. 6(1)(a) GDPR for the cookies and session replay. You can opt out at any time with the switch below — it sets a single opt-out marker and stops all collection in this browser. Do-Not-Track and Global Privacy Control are honoured automatically.
Waitlist
If you join the waitlist we store your email address and the time you signed up, in a Cloudflare KV store in the EU jurisdiction. It is used for exactly one purpose: to write to you once, when your spot in the beta opens. We do not send a newsletter and we do not share the address. The signup is also recorded as an event in PostHog (see above), linked to your analytics identifier. Legal basis: Art. 6(1)(b) GDPR (steps prior to a contract at your request). Email hello@ubrella.dev at any time to be removed.
The product (private beta)
When you connect an integration, Ubrella stores the credentials the provider issues (OAuth tokens or API keys) in a dedicated secrets store, never in ordinary database records, and uses them solely to read the data described in the docs for that integration. From that data we keep aggregates and daily snapshots — revenue per project per day, active-user counts, open pull-request counts, workflow results, and events such as “PR #182 merged”. We do not copy raw analytics events, source code, customer records or payment details. Data is stored on servers in the European Union. You can disconnect an integration at any time; its sources, metrics and events are deleted within 30 days. Deleting your workspace deletes everything.
Your rights
Access, rectification, erasure, restriction, portability and objection under Art. 15–21 GDPR, and the right to complain to a supervisory authority — for us, the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen.