Privacy Policy
Effective date: June 11, 2026
Last updated: October 13, 2026
Note: Contact [email protected] for questions or to exercise your data rights.
This Privacy Policy explains how SigmaShake ("SigmaShake," "we," "us") collects, uses, and protects information about you when you use the SigmaShake CLI (ssg), the Rules Hub, the SigmaShake API, the dashboard, promo.sigmashake.com, and our web properties (collectively, the "Services").
1. Who We Are
Data controller: SigmaShake
Contact: [email protected]
Address: United States (postal address available on request via [email protected])
For EU/UK data subjects, SigmaShake is the controller of your personal data. An EU/UK representative will be designated prior to broader EEA/UK marketing; contact [email protected] to request representative details.
2. Information We Collect
2.1 Account Information
When you register or authenticate, we collect:
- Email address
- GitHub user ID and username (if you use GitHub OAuth)
- Organization name and member list (Pro/Enterprise accounts)
- Password hash (if email/password registration is used)
2.2 Billing Information
Payments are processed by Stripe, Inc. We never see or store full payment card numbers. We receive and store:
- Billing email address
- Plan tier and subscription status
- Payment event records (invoices, renewals, cancellations)
- Business name and address (Enterprise, for invoice purposes)
2.3 Product Telemetry
When you use the SigmaShake evaluation engine (CLI, API, or MCP server), we may process:
| Category | Examples | Purpose |
|---|---|---|
| Agent tool-call metadata | Tool name, command fragments, timestamps | Rule evaluation, audit log |
| User identifiers | GitHub user ID, email (Pro/Enterprise only) | Authentication, plan enforcement |
| Device identifiers | One-way SHA-256 machine fingerprint (a hash derived from the OS machine ID, platform, hostname, and home directory path — not reversible to identify your hardware) | Plan enforcement, abuse prevention, pairing usage with your account on sign-in |
| Rule evaluation results | Decision (allow/block/ask/force/log/shadow), matched rule ID | Dashboard display, audit export |
| Usage metrics | Evaluation count, latency | Usage metering, service reliability, billing |
We do not process: full file contents read or written by the agent; source code in its entirety; credentials or secrets (our rules are designed to block their transmission).
CLI and Docker usage: Rule evaluation decisions and audit log events are processed locally by default. The daemon sends background heartbeats only in two cases. (1) The license heartbeat (accounts.sigmashake.com/api/v1/license/heartbeat) is sent about every 6 hours, and only when a license token exists on the machine. It includes your license token (JWT), the SHA-256 machine fingerprint, the SigmaShake version, and a daily evaluation count. The account service pairs the fingerprint with your account. It is used for plan enforcement, abuse prevention, and the evaluation counter in your accounts dashboard. (2) The fleet heartbeat (fleet.sigmashake.com/api/v1/agents/heartbeat) is sent every 5 minutes, and only from a device enrolled in Fleet. It includes the agent ID, the policy version, and the SigmaShake version. The agent token is sent in the request header. An install with no license and no Fleet enrollment sends no heartbeat. No tool-call content, file paths, source code, credentials, or rule bodies are included in either heartbeat. See Offline Mode for the full list of background calls. Cloud audit sync and fleet features store additional metadata only when enabled for Pro or Enterprise accounts.
2.4 Web Analytics (First-Party)
Our web properties send page views and product funnel events to a self-hosted analytics service (analytics.sigmashake.com). Analytics is cookieless today. No consent banner exists, and nothing sets the sigma_consent cookie. For this reason, the site sets no analytics-identifier cookie and no persistent or session analytics identifier. The sigma_resume cookie only prevents more than one daily sign-in analytics event for a signed-in user. That event carries your account user ID and login name. Events carry a random id that exists only in memory for one page load. If a future consent control sets sigma_consent=granted, the tracker would set sigma_anon (a persistent visitor id) and sigma_sid (a session cookie with no expiry). We do not use third-party advertising cookies. See our Cookie Policy for full details.
On sigmashake.com and promo.sigmashake.com, Google Analytics (GA4) runs in Consent Mode v2 with all storage denied by default. No consent banner exists today, so GA4 sets no cookies and sends cookieless pings only. promo.sigmashake.com, when Google Analytics is enabled, also sends page views to Google Analytics. Those views cover the public site and the signed-in dashboard. The OBS overlay and the celebrate view are not measured that way. This is not an advertising or remarketing tag.
2.5 Support and Communications
If you contact us by email or through a support channel, we retain the content of that communication and your contact details for the purpose of responding and improving our services.
2.6 Voice / Microphone Audio (Optional)
SigmaShake includes an optional, opt-in voice feature for dictating rules and voice prompts. It is off by default and you must turn it on. By default, transcription runs locally with Whisper. The audio stays on your machine, and no credentials are needed. An optional NVIDIA NIM backend needs your own NVIDIA key. When you enable voice:
| Category | Examples | Purpose |
|---|---|---|
| Microphone audio | Short audio clips you record while voice is active | Transcribe your spoken rule/prompt into text |
With the default local Whisper backend, the audio stays on your machine. Only if you enable the optional NVIDIA NIM backend with your own key, the captured audio is streamed to NVIDIA (see Section 5.2) to produce the transcription. If you do not enable voice, no microphone audio is captured or transmitted. The core governance product is fully functional with voice disabled.
2.7 Promo (promo.sigmashake.com)
promo.sigmashake.com (the per-streamer outbid listing board / Game Bar overlay) is in scope for this Privacy Policy. When you use Promo we collect:
- Listing content (creative, copy, bid metadata, and related board fields)
- Stripe payment records for listing/board charges (never card PAN)
- A salted IP hash used for abuse prevention
- Twitch and/or Google account identifiers, login handles, and email addresses obtained via OAuth (never passwords)
- Page views sent to Google Analytics when that tag is enabled (public pages and the signed-in dashboard; not the OBS overlay or celebrate view)
YouTube Super Chat rail: Channel owners may connect a YouTube Super Chat rail via Google OAuth with scope https://www.googleapis.com/auth/youtube.readonly (plus openid, email, and profile). We store encrypted (AES-256-GCM) access and refresh tokens to prove channel ownership (channels.list with mine=true) and to poll superChatEvents so listings can be credited. Tokens are not written to logs. The owner can disconnect the rail at any time. We do not sell Google/YouTube user data, and we do not use it to train AI models.
3. How We Use Your Information
We use the information we collect to:
- Provide and operate the Services — authenticate you, evaluate rules, serve the dashboard, enforce plan quotas.
- Billing and account management — process payments, send invoices, manage subscriptions.
- Security and abuse prevention — detect and investigate misuse per our Acceptable Use Policy.
- Legal compliance — respond to lawful requests, enforce our Terms of Use, fulfill retention obligations.
- Product improvement — analyze aggregated, anonymized usage patterns to improve the rule engine and developer experience.
We do not use your data for advertising, sell it to third parties, or use it to train AI models without your explicit consent.
4. Legal Bases for Processing (GDPR)
For users in the European Economic Area, United Kingdom, or Switzerland:
| Processing activity | Legal basis (GDPR Art. 6) |
|---|---|
| Account creation and authentication | Performance of contract (Art. 6(1)(b)) |
| Rule evaluation and audit log | Performance of contract (Art. 6(1)(b)) |
| Billing | Performance of contract (Art. 6(1)(b)) |
| Security and fraud prevention | Legitimate interest (Art. 6(1)(f)) |
| Product analytics | Legitimate interest (Art. 6(1)(f)) |
| Legal obligations (tax records) | Legal obligation (Art. 6(1)(c)) |
You may object to processing based on legitimate interest at any time by contacting [email protected].
5. Sharing Your Information
We share your data only as follows:
- Sub-processors — third parties we engage to operate the Services (see Section 5.1).
- Legal requirements — if required by law, court order, or regulatory authority.
- Business transfers — in connection with a merger, acquisition, or sale of assets, subject to confidentiality obligations and notification to affected users.
- With your consent — in any other case, only with your explicit permission.
We do not sell your personal data. SigmaShake is not a "data broker" under CCPA or any comparable law.
5.1 Sub-processors
Sub-processors process data on our behalf. The public list is at sigmashake.com/sub-processors. The machine-readable feed is at compliance.sigmashake.com/api/v1/sub-processors.json.
Updated 2026-10-09: the list now includes Google (Analytics, Fonts), Cerebras and jsDelivr, which were in use but not listed before.
| Sub-processor | Purpose | Data processed | Location | DPA status |
|---|---|---|---|---|
| Cloudflare, Inc. | Infrastructure: compute, storage, CDN, WAF, DNS, email routing, Workers AI | Hosted content, visitor IP, request metadata | USA (SCCs apply for EEA data) | DPA on file |
| Stripe, Inc. | Payments and billing | Billing contact, subscription metadata | USA | DPA on file |
| GitHub, Inc. | Source hosting and GitHub App / OAuth sign-in for staff and customers | Source and config, account IDs | USA | DPA on file (Microsoft umbrella) |
| Anthropic | AI inference: chat, rule drafting, support triage, sales classification | Prompts, ticket text, sales email content | USA | DPA on file |
| Resend | Outbound email | Recipient address, subject, body | USA | DPA on file |
| Google LLC | Analytics (GA4 in Consent Mode v2, consent denied by default; no consent banner exists, so GA4 sets no cookies and sends cookieless pings only) and Google Fonts | Page views, visitor IP, user agent | USA — DPA and transfer assessment pending | DPA pending |
| Cerebras | AI inference for rule drafting | Rule-drafting prompts | USA — DPA and transfer assessment pending | DPA pending |
| jsDelivr | CDN for browser libraries | Visitor IP, user agent, referrer | Global CDN — DPA and transfer assessment pending | DPA pending |
5.2 Platforms you choose to connect
These platforms are independent controllers. They are not our sub-processors. We exchange data with them only when you connect them.
- Google Sign-In and YouTube account link (
youtube.readonly) - Twitch, Kick, Reddit, Microsoft, Apple, X and Discord
- NVIDIA: only if you enable the optional voice backend with your own NVIDIA key. Microphone audio then goes to NVIDIA for transcription. Voice is off by default.
Have I Been Pwned (HIBP) receives only a k-anonymity hash prefix. It is not a sub-processor.
We publish changes to this list on the public page and in the JSON feed above. These are the notice channel. Email notice of changes is planned and is not available today. See DPA Section 7 for the objection right.
6. International Data Transfers
SigmaShake is operated from the United States. If you access the Services from outside the US, your data may be transferred to and processed in the US. For EEA data, the EU Standard Contractual Clauses (SCCs) apply for Cloudflare, as the table in Section 5.1 shows. No UK or Swiss transfer mechanism is recorded yet. A UK Addendum to the EU SCCs (or the UK IDTA) and a Swiss addendum are targets only, not signed instruments (2026-10-13). The transfer mechanism for our other US sub-processors with a DPA on file (Stripe, GitHub, Anthropic and Resend) follows the terms of their DPAs. The DPA and transfer assessment for Google, Cerebras and jsDelivr are pending. We do not claim the SCCs as a general safeguard for all sub-processors, and no transfer impact assessment records exist yet. Contact [email protected] with questions about a transfer.
7. Data Retention
| Data type | Retention period |
|---|---|
| Audit log events (local-only use, no paid subscription) | Not stored in cloud |
| Audit log events, Hub (Pro) | Synced rows from the last 7 days can be read and exported. Older rows are hidden from those views, not deleted |
| Audit log events, Hub (Enterprise) | Synced rows from the last 90 days can be read and exported. Older rows are hidden from those views, not deleted |
| Audit log events, Fleet | Deleted by a daily purge at 02:00 UTC after the organization's audit_retention_days (default 90) for organizations with Fleet enabled |
| Identity-provider (SSO) audit events | Never deleted. A nightly export writes them to R2. A 7-year Object Lock on that export is an operator target, not a control in code |
| Account administrator audit log | Append-only. No deletion job exists |
| Audit log events on your machine | Capped by row count (50,000 soft, 500,000 hard), not by days |
| Billing records | 7 years (legal requirement) |
| Account data | Until account deletion, then deleted (target: 30 days) |
| Ads YouTube/Twitch rail tokens | Until the owner disconnects the rail or the channel is deleted |
| Promo listing / payment ledger | Retained for ranking and board history |
When you delete your account, our target is to delete your personal data from active systems within 30 days, except billing records retained as required by law. This 30-day period is a target, not a guarantee. Automated deletion jobs for account profile, authentication factor, support, and billing data are not yet verified, and deletion from secondary stores (such as backups) is planned. SigmaShake does not enforce one audit-retention period across all stores. No cold tier exists. This retention schedule is also reflected in our DPA (Section 10). Dated note 2026-10-13: this audit-log wording replaces earlier text that said enforced day limits ship in a future release.
8. Your Privacy Rights
8.1 GDPR Rights (EEA / UK / Switzerland)
If you are located in the EEA, UK, or Switzerland, you have the right to:
- Access — obtain a copy of your personal data.
- Rectification — correct inaccurate or incomplete data.
- Erasure ("right to be forgotten") — request deletion of your data (subject to legal retention obligations).
- Portability — receive your data in a machine-readable format.
- Restriction — limit how we process your data in certain circumstances.
- Objection — object to processing based on legitimate interest.
- Withdraw consent — where processing is based on consent, withdraw it at any time without affecting prior processing.
You also have the right to lodge a complaint with your local supervisory authority.
8.2 CCPA Rights (California Residents)
If you are a California resident, you have the right to:
- Know — request disclosure of the categories and specific pieces of personal information we collect, use, disclose, and sell (we do not sell).
- Delete — request deletion of your personal information, subject to exceptions.
- Opt out of sale — we do not sell personal information; this right is not applicable.
- Non-discrimination — we will not discriminate against you for exercising your CCPA rights.
8.3 How to Exercise Your Rights
Email [email protected] with your request. Our acknowledgement target is 1 business day. Our completion target is 15 days. The legal deadline is 30 days. We can extend it by up to 60 days and will give you notice if we do. These are targets, not guarantees. We may ask you to verify your identity before processing the request.
9. Children's Privacy
The Services are not directed to children under the age of 16. We do not knowingly collect personal data from anyone under 16. If you believe a minor has provided us with personal data, contact [email protected] and we will delete it promptly.
10. Security
We implement technical and organizational measures to protect your data, including TLS 1.3 in transit on the SigmaShake Worker hostnames (the Cloudflare edge rejects TLS 1.2 and older there; docs.sigmashake.com also accepts TLS 1.2), AES-256 encryption at rest, role-based access controls, and documented breach response procedures. See our Security Policy and DPA (Section 6) for details. If a Sev-1 incident exposes your data, you receive an email from [email protected] within 72 hours of confirmation of the incident. Where you are the controller and SigmaShake is the processor of a Personal Data breach, the target is without undue delay, within 36 hours of confirmed awareness. This is a target, not a guarantee.
11. Cookies
See our Cookie Policy for the cookies we use and how to control them, including the Google Analytics tag on sigmashake.com and on promo.sigmashake.com (when that tag is enabled). GA4 runs in Consent Mode v2 with consent denied by default and sets no cookies today. We do not use third-party advertising cookies.
12. Changes to This Policy
We may update this Privacy Policy to reflect product changes or legal requirements. We publish material changes by updating this page. Email or in-product notice of changes is planned and is not available today. No fixed notice period is guaranteed. The "Last updated" date at the top of this page will always reflect the most recent version. Continued use of the Services after the effective date of changes constitutes acceptance.
13. Contact
Privacy questions and data subject rights requests: [email protected]
Security incidents: [email protected]
Enterprise DPA inquiries: [email protected]