Privacy
What we store, and what we do not
Short version: we keep what running your account needs, and nothing else. No ad networks, no data brokers, nothing sold to anyone.
Your account
When you sign in we store your email address. If you sign in with GitHub we also store the name and avatar URL GitHub gives us. That is the whole profile.
Your project data
Flags, environments, keys, members and settings, plus an audit log of who changed what and when, and per-day counts of how often each flag was evaluated. Deleting a project deletes its data.
Your users
Almost never, and only when you ask for it. A percentage rollout or a variant pick is decided by hashing the identifier your app supplies, and in the SDK’s default local mode that happens inside your own process, so the identifier never reaches us at all. We hold no list of your users, and nothing we store about a flag check is tied to a person: the per-day counts are totals, with no identifier in them.
There are exactly two exceptions, both of which you switch on deliberately. An allowlist holds the ids or email addresses you type into the dashboard, because we have to store the rule to enforce it. A first-N rollout stores the identifier of each user admitted, because counting distinct people is impossible without remembering which people. Both are per flag and per environment, both are deleted with the flag or the project, and neither is used for anything except deciding that flag.
We do not profile, segment, enrich or sell any of it, and we never use it to train anything. If you would rather we held nothing at all, a domain allowlist written *@acme.com stores a domain instead of your colleagues’ addresses, and a percentage rollout stores nothing whatsoever.
Sub-processors
Seven companies touch some part of running LaunchFlag. That is the whole list.
| Sub-processor | What it does for us |
|---|---|
| Railway | Hosting and the Postgres database, in the United States. |
| Cloudflare | DNS, CDN and edge cache for the public site and the config document. |
| Dodo Payments | Merchant of record: checkout, payments and invoices. |
| Resend | Transactional email, sent from mail.launchflag.dev. |
| DataSlow | Self-hosted analytics. Cookieless, and no IP address stored. |
| PostHog | Product analytics, on their EU servers. No session replay, no autocapture, and no profile for a visitor who never signs in. |
| Sentry | Error reporting, on their EU servers. Errors only: no session replay, and project ids are stripped from URLs. |
Payments
Dodo Payments is the merchant of record. The card is typed into their checkout, not ours, so a card number never reaches our servers and we never store one. What comes back to us is what an invoice needs: your email, which plan you are on, and whether the last payment went through.
Analytics
We use DataSlow, a self-hosted, cookieless analytics tool, to count visits and understand which pages people find useful. It does not store your IP address or use tracking cookies, it does not build cross-site profiles, and no data is sold or shared with advertisers.
To be exact: it does write two keys into your browser's localStorage, _dataslow and _dataslow_uid, so it can tell a first visit from a repeat one and tie dashboard activity to your signed-in account.
Contact
Questions, or want your data deleted? Email contact@launchflag.dev.
Back to LaunchFlag