Legal

Privacy Policy

Effective October 1, 2026

This policy explains what DeployAngel collects, why, how long we keep it, and the choices you have. DeployAngel is run by Jordan Owens, an individual based in Ohio, USA ("we" and "us"). It covers the website at deployangel.com, the dashboard and API at app.deployangel.com and api.deployangel.com, and the deployangel agent.

What we collect

Account information

• Your name, email address, team name, and role.
• Your password, stored only as a secure hash.
• Whether you've verified your email address, and which accounts' team emails you've turned off.
• The email addresses of people you invite.
• For each sign-in session: your IP address, your browser's user agent, and when the session started.
• If you sign in through Heroku: your Heroku email address and user ID.

Telemetry from the agent

The agent summarizes what your app does inside your app, and sends that summary about once a minute:

• Request counts, status codes, and response-time histograms for each normalized route, such as GET /users/:id. IDs in paths are never sent.
• Background job counts, failures, durations, and queue delays for each job class.
• Exceptions: the exception class, where in your code it happened, and its message with numbers, IDs, email addresses, and quoted text replaced by placeholders. Occasionally, a stack trace limited to your application's own files.
• The release version and commit, and which process sent it, such as the dyno or host name.
• The names and counts of any checkpoints and critical flows you define.
• Unless you turn it off with DEPLOYANGEL_FILE_DIGESTS=false, the paths and SHA-256 hashes of your app's files, so we can tell which files changed between releases. Never their contents.

The agent never sends request or response bodies, headers, cookies, query parameters, session data, SQL parameter values, or records from your database.

Releases and connected services

• Deployments: the version, commit, time, and where each came from, such as a Heroku webhook, your CI, or the agent's telemetry, when DeployAngel notices a new release itself.
• GitHub, if you connect it: read-only access to the repository you choose, used to work out what changed in each release. We keep a summary of the changed files, dependency and framework versions, migrations, and pull request numbers, titles, and links, not your source code. The one exception is AI investigation, below.
• Heroku, if you use the add-on: your app and add-on names, your plan, and release events.
• Slack: the incoming webhook URL you add, stored encrypted.

AI investigation (optional)

AI investigation is off by default for every app. When it's on and a release fails, we send Anthropic a small bundle of evidence: the failing findings, new exceptions, what changed, and, if GitHub is connected, short excerpts of the few most relevant changed files. The explanation that comes back is stored with the release, along with the evidence we sent.

The contact form

Your name, email address, and message, emailed to us so we can reply. DeployAngel itself doesn't keep a copy.

Cookies, fonts, and logs

• The dashboard uses essential cookies to keep you signed in and to protect its forms. There are no analytics, advertising, or tracking cookies.
• deployangel.com runs no scripts and sets no cookies of its own.
• Both sites load fonts from Google Fonts, so Google receives your IP address and browser details when a page loads.
• We and our hosting providers keep standard request logs, such as IP addresses and times, for security and reliability.

How we use it

• To run DeployAngel: verify your releases, show them in the dashboard, send the notifications you set up, and answer your messages.
• To keep the service secure, prevent abuse, and fix problems.
• To tell you about important changes to the service or to these policies.

We don't sell personal data, and we don't use it for advertising.

Who else processes it

We use these providers to run DeployAngel. Each gets only what it needs for its job:

• DigitalOcean hosts the dashboard, API, and database.
• Heroku (Salesforce) bills customers who use the Heroku add-on.
• Cloudflare hosts deployangel.com and serves our DNS.
• Resend sends our emails: notifications, invitations, email address verification, password resets, notices when your email address or password changes, and contact form messages.
• Honeybadger receives error reports when part of DeployAngel fails. A report can include the request that failed, your IP address and browser, and your user ID. Passwords, tokens, and the cookie that keeps you signed in are removed first.
• Anthropic runs AI investigation, only for apps where it's turned on.
• Google Fonts serves the fonts on both sites.

GitHub and Slack only get requests when you connect them: we read from GitHub, and post to the Slack webhook you add. We may also share data when the law requires it, or to protect the service or other people from harm. If DeployAngel is ever sold or merged, your data would move with it, still covered by this policy.

How long we keep it

• Release history: 7, 30, or 90 days, depending on your plan. Each app's latest release and its last two cleared releases are kept as baselines.
• Telemetry: for the same period, but at least 21 days, so baselines have enough history to learn from.
• Account information: until you close your account.
• Deleted apps: deleted right away. Apps whose Heroku add-on is removed are deleted 7 days later.

How we protect it

• All traffic uses HTTPS.
• Passwords are hashed. API tokens and invitation links are stored only as hashes, so we can't read them back.
• Slack webhook URLs and Heroku secrets are encrypted in the database.
• Each account's data is kept separate, and only its members can see it.

Your choices and rights

• Ask us to access, correct, export, or delete your personal data through the contact form. Account owners can also delete apps in Settings at any time.
• Turn off file digests in the agent, and leave AI investigation off.
• Turn off team emails for any account in your profile.
• Depending on where you live, for example in the EU, the UK, or California, you have further rights, such as objecting to processing, and complaining to your data protection authority. We'll respond to requests within 30 days.
• DeployAngel is built not to receive personal data about your app's users. If you think it has, tell us and we'll delete it.

Where your data is processed

DeployAngel is hosted in the United States. If you use it from somewhere else, your data is transferred there and processed under this policy.

Children

DeployAngel is for professionals, not children. We don't knowingly collect data from anyone under 16.

Changes to this policy

We'll post any changes here and update the date at the top. For material changes, we'll tell account owners by email or in the dashboard before they take effect.

Contact

For privacy questions or requests, use the contact form and choose "Privacy or security".