Privacy Policy

Introduction

This Privacy Policy explains how WindKeep collects, uses, and protects your personal information when you access or use the WindKeep web application and command-line interface (CLI).

In this Policy, “we”, “us”, and “our” refer to the controller identified below, and “you” and “your” refer to users of the service.

Controller

The controller of personal data processed through WindKeep is Matheus Mortari, a natural person operating the service.

Contact for privacy requests: matheus.felipe.19rt@gmail.com. The same contact acts as the channel for data-subject requests under the Brazilian General Data Protection Law (LGPD — Lei nº 13.709/2018).

Legal Bases (LGPD)

We process personal data only when a legal basis under LGPD Article 7 applies, including:

  • Performance of a contract (Art. 7, V) — creating and maintaining your account, authenticating you, storing and delivering secrets you request, and providing org/project access controls.
  • Legitimate interest (Art. 7, IX) — security, fraud prevention, rate limiting, audit logs of administrative actions, and basic reliability monitoring, balanced against your rights.
  • Compliance with a legal obligation (Art. 7, II) — when we must retain or disclose data to meet applicable law.
  • Consent (Art. 7, I) — where an OAuth provider requires it, or where we ask for an optional permission that is not necessary for the core service.

Information We Collect

We collect information needed to operate and secure the service, including:

  • Account information received from OAuth providers (Google, GitHub, GitLab), such as name, email, and profile image.
  • Secrets and configuration data you create, store, or share within projects (encrypted at rest).
  • Technical data such as IP address, user agent, and authentication cookies, including data recorded in security/audit logs.
  • Cloudflare Web Analytics on the production website.

How We Use Your Information

We use the information we collect to:

  • Provide, maintain, and secure the service.
  • Authenticate users and secure accounts.
  • Operate audit trails for administrative and secret-management actions.
  • Communicate important updates, including security alerts and policy changes.
  • Comply with legal obligations and protect the platform and its users.

Sharing and Disclosure

We do not sell your personal information. We may share data under the following circumstances:

  • With infrastructure and service providers that help us host, secure, or deliver the platform (for example hosting, database, Redis, object storage, and Cloudflare).
  • With OAuth identity providers when you choose to sign in through them.
  • When required by law, legal process, or a competent authority.
  • To protect the rights, safety, or property of WindKeep, its users, or third parties.

Cookies and Tracking

WindKeep uses cookies and similar technologies as follows:

  • Essential cookies for authentication and session security.
  • Cloudflare Web Analytics on the production website.
  • Local preference storage for settings such as color theme.

Data Retention and Security

We retain personal and organizational data only as long as necessary to provide the service or comply with legal obligations. You may delete your account from preferences, subject to organization-ownership constraints. Secrets are encrypted at rest (AES-256-GCM), and we apply technical and organizational measures intended to reduce unauthorized access, disclosure, or misuse.

Your Rights (LGPD)

Under the LGPD, you may request:

  • Confirmation of processing and access to your personal data.
  • Correction of incomplete, inaccurate, or outdated data.
  • Anonymization, blocking, or deletion of unnecessary or excessive data, or of data processed in noncompliance with the LGPD.
  • Portability of data to another service provider, subject to ANPD regulation and technical feasibility.
  • Information about public and private entities with which we shared data.
  • Information about the possibility of denying consent and the consequences of that denial.
  • Revocation of consent, where processing is based on consent.

Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected on this page. Continued use of WindKeep after an update constitutes acceptance of the revised policy.

Contact

Privacy and LGPD requests: matheus.felipe.19rt@gmail.com.