DevRails Privacy Policy

Because DevRails is currently in active development and early access, our data collection is currently limited to waitlist operations and basic website hosting.

• Information you provide directly: When you join our waitlist, we collect your email address (required), as well as optional information you choose to share, such as your name, role, primary GCP concerns, the number of GCP projects you manage, and your consent to receive early-access updates. Please do not submit sensitive personal information through the waitlist form or support channels unless we specifically request it.
• Information collected automatically: Our hosting and database providers, such as Vercel and Supabase, automatically collect basic technical metadata when you visit our site. This includes your IP address, browser type, device information, timestamp data, and standard server logs necessary for security and debugging.
• Storage Location: Our current waitlist database is hosted through Supabase in the United States, us-east-1 / North Virginia.

As we launch product access, our data collection will expand to operate the DevRails tool. We may collect:

• Account & Billing Data: Authentication details, subscription status, and payment metadata, processed via third parties; we do not store full credit card numbers.
• GCP Environment Data: GCP project identifiers, connection metadata, threshold configurations, guardrail/killswitch settings, and specific usage metrics, such as Cloud Run traffic and Cloud Functions invocations, needed to trigger alerts.
• Operational Logs: Alert histories, automated action histories, audit logs, support messages, and basic product usage analytics, such as which features are used or where errors occur.
• Community Feedback: Information you share if you participate in our Discord or pilot feedback groups.

Security Note: DevRails will not require you to submit raw GCP secret keys through our public landing page. Future GCP connections will utilize supported mechanisms like OAuth, service accounts, or Workload Identity Federation.

We use the information we collect to:

• Manage waitlist signups and send early-access or product updates. We may use your email address to prevent duplicate waitlist submissions and manage your waitlist status.
• Understand product demand to improve the DevRails roadmap.
• Operate, secure, and debug the www.thecollcon.com website.
• Provide product access, monitor supported GCP usage signals, send alerts, and trigger user-enabled guardrails once the product is live.
• Manage subscriptions and process payments.
• Provide customer support and detect platform abuse or security threats.
• Comply with legal and accounting obligations.

We process your data based on several legal grounds: your consent, such as joining the waitlist; to fulfill a contract, such as providing the DevRails service to registered users; for our legitimate interests, such as security, debugging, and product improvement; and to comply with legal obligations.

Depending on your location, including users protected by the GDPR or California privacy laws, you may have the right to:

• Access the personal information we hold about you.
• Correct inaccurate or incomplete data.
• Delete your personal information.
• Restrict or Object to certain processing of your data.
• Export your data in a portable format.
• Withdraw Consent at any time, such as unsubscribing from emails.
• Non-Discrimination: You will not be penalized or charged different rates for exercising your privacy rights.

We do not sell your personal information. We also do not share it for cross-context behavioral advertising unless clearly disclosed in the future. To exercise any of these rights, please contact us at support@thecollcon.com. We may ask for information reasonably necessary to verify your identity before fulfilling a privacy request.

We do not operate our own physical servers. We share data only with third-party service providers necessary to run DevRails:

• Supabase: For database and waitlist storage.
• Vercel: For website hosting and deployment.
• Future Providers: We may integrate providers like Stripe for payments, email delivery services, Telegram for alert delivery, or product analytics tools as the platform grows. We will also interact with Google Cloud APIs specifically to provide the monitoring features you request.

These providers are authorized to process your data only as necessary to provide their specific services to us.

DevRails is operated from the Republic of Indonesia, but our infrastructure relies on global cloud providers. Currently, our Supabase database is hosted in the United States, us-east-1 / North Virginia. By using our website or joining our waitlist, you understand and acknowledge that your information may be transferred to, stored, and processed in the United States and other regions outside your country of residence.

• Waitlist Data: Retained until you unsubscribe, request deletion, or we no longer need it to communicate early access updates.
• Future Product Data: Account data is retained while your account is active. Billing records are kept as required by tax and accounting laws. GCP usage metrics will be designed for short retention periods where practical. Audit and action logs may be retained longer to help you trace alerts and security events. Routine backups are kept for a limited time before being overwritten.

We may delete records that are no longer needed for early access, security, operations, or legal purposes.

We use reasonable technical safeguards to protect your data, including limited access controls, Row Level Security (RLS) on databases, and secure environment variables for system configurations. However, no method of digital transmission or storage is perfectly secure, and we cannot guarantee absolute security. Data collected through our service will be handled as described in this Privacy Policy.

If you connect GCP projects to DevRails in the future:

• We only access the metrics and data signals strictly needed to provide supported features.
• You control which environments you connect and are responsible for reviewing the permissions you grant.
• We recommend a least-privilege approach to granting permissions.
• DevRails does not claim any ownership over your GCP data, source code, or cloud architecture.

We may send you waitlist updates, early-access invitations, product announcements, and service messages. You can unsubscribe from marketing or waitlist updates at any time by clicking the link at the bottom of our emails. Please note that this unsubscribe mechanism may not apply to operational notices. If you become an active product user, we may still send you mandatory operational, security, and billing notices.

DevRails is a business and developer tool. It is not intended for use by children, and we do not knowingly collect personal information from children. You must be legally able to enter into binding agreements to use our services.

Because DevRails is in active development, this Privacy Policy will evolve. We will update this page as our data practices change, and we will notify active users of material changes where reasonable, for example, via email.

If you have any questions about this Privacy Policy or your data rights, please contact us at support@thecollcon.com.