Privacy notice

Who we are

Bitskiff is run by [Legal entity], which is responsible for the data this notice describes. You can reach us about privacy at [Contact address].

What we collect about developers

• Your email address, which is how you sign in. We keep no password.
• The organizations you belong to and your role in each.
• The projects, keys, limits and settings your organization creates. A secret key is shown once and is not kept in a form that can be shown again.
• A record of each change made in an organization: who made it, when, and the IP address it came from.

If you turn on two-factor authentication, the factor is held by Google Cloud Identity Platform.

What we collect about clients

A client joins a session without an account. For each client we record the kind of device (mobile, tablet, desktop), the operating system family, the type of network where the browser reports it, and the country, which is worked out from the IP address. We do not record a client's IP address, user agent string, device identifier or name, and we set no persistent cookie on a client's device.

If a developer's app gives a client a label or its own id for the person, that label or id is kept with the session's records.

What passes through a session

What a host and its clients send each other passes through our servers so it can be delivered. We count the messages and bytes for usage, and we do not keep what was sent once it is delivered. When a project uses end-to-end encryption, our servers carry the messages without being able to read them.

How we use it

We use this information to run sessions, to sign you in, to meter usage and show it to you, to apply limits, and to protect the service from abuse. We do not sell it, and we do not use it for advertising.

IP addresses

The service reads the IP address of every request. For a client, it is used to work out the country and to apply rate limits: it is held for ten minutes for rate limiting and is never written to a usage record. For a change made in the console or with an organization key, it is written to that organization's audit record.

How long we keep it

• A session's live record: 24 hours after the session ends.
• Raw usage events: up to 90 days.
• The usage ledger, which totals each session's usage: up to 400 days.
• The audit record of changes in an organization: 400 days.
• Your account, organizations, projects and keys: while they exist.

Cookies and browser storage

The console sets a cookie that keeps you signed in. When it sends you a sign-in link, it remembers the address in your browser so the link can finish signing you in; it never stores the link itself. This site and the docs set no cookies and run no analytics or advertising scripts.

Who processes it

• Google Cloud runs the service: its servers, databases and logs, and sign-in through Identity Platform.
• Resend sends our email: sign-in links and account and security notices. It receives the address and the message.

Where it is kept

The service runs in Google Cloud's us-central1 region, in the United States.

Your choices

You can revoke your organization's keys at any time, and an organization's owners decide who is a member and what each member may do. A client can leave a session at any time, and a developer can end a session or remove a client from it.

To ask for a copy of the data we hold about you, or for its deletion, write to [Contact address] from the email address you sign in with. A client's request about a session goes to the developer whose app it is; we help the developer answer it.

Changes

When this notice changes, the new version is published here with its date.