Privacy notice

Last updated 1 October 2026.

This notice explains how Draugr handles personal data collected through this website and through the Draugr Server hosted service, and what the Draugr software sends and to whom. The sections before The hosted service cover the website.

Personal data we collect

Only what you submit through the contact form: your name, email address, and the content of your message.

Our hosting provider processes technical data inherent to serving any website, including IP addresses, in its server logs.

Purpose and lawful basis

We use contact form submissions solely to respond to your enquiry and to correspond with you about it. The lawful basis is our legitimate interest in replying to people who contact us, and taking steps at your request prior to entering a contract where relevant.

Recipients

We do not sell personal data or share it for advertising. We disclose it only to service providers who process it on our behalf, website hosting, analytics, spam screening and email delivery, and where required by law.

To screen the contact form for automated and known spam submissions, the form runs a bot check provided by our hosting provider, and we check a one-way hash of the email address you enter against a public list of addresses reported for spam. The address itself is not sent for that check.

Retention

Correspondence is kept for as long as needed to handle your enquiry and any follow-up, and deleted when it no longer serves that purpose.

Cookies and analytics

This website sets no cookies and uses no advertising or tracking technologies. It uses our hosting provider's web analytics, which counts page views in aggregate without cookies and without identifying visitors. We also maintain an aggregate count of installation-script downloads, which contains no personal data and cannot be linked to any individual.

Software

The Draugr command-line software and its plugins for AI assistants run on your computer and send us nothing. A scan runs the scanners your descriptor selects, and some of them contact third parties: they download vulnerability databases and rule sets from their publishers, hosted scanning services receive what their scanner sends, and scans of a live service send traffic only to the endpoints you declare. Those parties handle that data under their own terms. The catalog names each host and what is sent to it.

The hosted service

This section applies when you use Draugr Server as a service we run ("the service"), as the terms describe it.

Roles

An organization on the service decides whom it invites and what it publishes, and is the controller of that data. We process it on the organization's behalf, to provide the service to it. For the account, session and security data used to sign people in and to protect the service, and for the waiting list, we are a controller.

Data

• Account: Your email address and name, and either a hash of your password or the account identifier of the sign-in provider you chose, GitHub or Google.
• Sessions: The IP address and browser of each signed-in session.
• Activity: A record of the changes made in an organization, each with the email address of the person who made it.
• Mail: The addresses that invitations and notices are sent to. The service sends mail about accounts and organizations only.
• Support: The messages you send through the service, with the page and browser they were sent from.
• Waiting list: Your email address, if you join the list for registration.
• Organization content: The scan reports an organization publishes and the pipeline details sent with them, its findings with the file paths they point to, and who accepted each accepted finding. Scanner evidence files can contain excerpts of source code.

Retention

• Findings history: between 90 days and three years, according to the organization's plan. Open findings and the activity record are kept for as long as the organization exists. When the period is shortened, the shorter period applies 30 days after the organization's owners are told of it.
• Scanner evidence files: at most 7 days.
• Sessions: 14 days, or the period the organization sets, at most a year.
• Invitations: 7 days, or the period the organization sets, at most 30 days.
• Password reset links: 1 hour.
• Unconfirmed registrations: 24 hours.
• Waiting list: 24 hours for an unconfirmed address, and 30 days after we tell a confirmed address that registration has opened.
• Closed organizations: deleted with everything they hold by the daily deletion pass once 90 days have passed since closing. We keep the organization's name and the date it was deleted.
• Database history: deleted data remains in the database's point-in-time history for up to 7 days.

Erasure

An organization's owners and admins can deactivate a person and then erase their data. Erasure removes the person's credentials, sessions, tokens, roles, team memberships, support messages, preferences, and the invitations and notices sent to their address. Their name and email address stay on the organization's activity record until the organization is deleted, because that record is the organization's account of who granted access and who accepted a risk.

To have your data erased, ask the owners or admins of your organization. We erase a member's data on the written instruction of the organization's owners or admins, and delete a closed organization before its 90 days have passed on the written request of an owner. Once an organization is deleted, write to support@draugr.dev and we act on your request ourselves.

Cookies

The service sets two cookies, both needed to sign in, and none for analytics or advertising.

• draugr_session keeps you signed in, for as long as the session lasts.
• draugr_oauth holds a sign-in through GitHub or Google while it completes, for 10 minutes.

Your theme and motion preferences are kept in your browser's local storage. The search and filters last used on each list, and the notice shown after an organization closes, are kept in the browser tab's session storage and cleared when the tab closes.

Monitoring

We collect performance traces and metrics from the service to operate it. They are stripped of IP addresses, browser details and page addresses before they leave the service.

Processors

Service providers process data for the service in these categories, each in the eastern United States unless noted.

• Application hosting
• Database
• Object storage for evidence files
• Email delivery
• Monitoring
• Content delivery and DNS, through locations worldwide

GitHub and Google handle a sign-in through them under their own terms.

Your rights

Subject to applicable law, you may request access to, correction of, or deletion of your personal data, and may object to or restrict its processing. To exercise these rights, contact us at support@draugr.dev. You may also lodge a complaint with your local supervisory authority.

For data held by an organization on the hosted service, ask the organization first, as Erasure describes.

Changes

We may update this notice. The date above reflects the current version. Where a change materially affects personal data we already hold, we will notify affected individuals directly.

Contact

Questions about this notice: support@draugr.dev.