Privacy Notice

1. Who is responsible

Holodeck is a service of MSS Desenvolvimento de Software Ltda. (“we”, “us”), CNPJ 36.600.292/0001-40, Rua Emídio Francisco da Silva, 531, Sala 02, São José, Santa Catarina, 88111-560, Brazil.

This notice covers holodeck-tracker.com, app.holodeck-tracker.com, the Holodeck MCP server and the holodeck command-line tool. It is written with Brazil’s data protection law (LGPD) and, where it applies to you, the European Union’s and the United Kingdom’s GDPR in mind.

We play two roles:

• For your account, your sessions, billing and our own site, we decide why and how the data is used (we are the controller).
• For the content people and agents write into an organization (tasks, discussions and the like), the organization decides, and we process that content on its behalf (we are its processor, or operator). Questions about that content go first to the organization’s owner.

Questions about this notice, or requests about your data, go to support@holodeck-tracker.com, which also reaches the person in charge of data protection at our company.

2. What we collect

When you sign in. From GitHub: your name, your email address, the other verified email addresses of your GitHub account (to match an invitation, not kept), your GitHub username, your profile picture and your GitHub account’s identifier. We never receive your GitHub password, and we do not ask for access to your repositories. From Google: your name, your email address, your profile picture and your Google account’s identifier. We never receive your Google password, and we ask for nothing else in your Google account.

Your username. The @ you choose in Holodeck, by which others mention you.

Each time you sign in. A record of the sign-in: its date and time and the IP address it came from. Brazilian law requires us to keep it.

While you use the app. For each session: when it started, its IP address and the browser it came from. In your organization: your role, the projects you belong to, and what you did on the board (who created, changed or commented on what, and when).

Invitations. When someone invites you: your email address, typed by the person inviting. We use it to send you the invitation and to recognise you when you sign in, and we keep it with the invitation.

Content. What you and your agents write: projects, tasks, intentions, discussions, mentions and their history.

Agents. Each agent’s name, its instructions, the projects it can reach, a protected (hashed) copy of its token, and when it connected.

What agents are doing. For agents started with the holodeck tool: the name of each tool the agent runs, when it started and ended, and whether it failed. From this we compute how long work took and which tools were used.

Billing. Payments are handled by Paddle. We receive from Paddle your organization’s customer and subscription identifiers, the plan, the number of seats, the status and the dates. We never receive or store card numbers.

Where you came from. If the link that brought you to the app said so, the name of the page or campaign it came from. It is kept in your browser until you create an organization, and then on that organization.

When you write to us. Your email address and what you tell us.

Technical logs. Our servers log requests (time, address requested, IP address, result) to keep the service running and secure.

3. What we do not collect

• Your code. Your agents work on your own machines. Holodeck does not receive your source code, the input or output of the tools your agents run, their conversations with the AI model, or the model’s reasoning.
• Advertising data. We run no advertising trackers, and we do not sell personal data or share it for advertising.

4. Why we use it

• To provide Holodeck to you (performing our contract with you): your account, your sessions, your content, your agents and their activity, invitations, and billing.
• To keep Holodeck secure and working, and to understand how it is used (our legitimate interests): technical logs, visit counts on our site, where sign-ups come from, and usage against plan limits.
• To meet legal duties: the record of each sign-in, which Brazil’s Marco Civil da Internet requires us to keep, tax and accounting records, and answering lawful requests from authorities.

We do not make decisions about you by automated means that have legal effects on you.

5. Cookies and your browser’s storage

• The app sets one cookie that keeps you signed in, and a second one for about five minutes while you sign in with GitHub or Google, which protects that step. Both are necessary for the app to work.
• The checkout is run by Paddle, which may set cookies of its own while it is open, under its privacy policy.
• The app also keeps a few settings in your browser’s storage: the width of a panel, the project you were last in, the filters you set on a board, and where you came from until you create an organization. They stay in your browser.
• Our site (holodeck-tracker.com) sets no cookies. Visits are counted with Cloudflare Web Analytics, which uses no cookies and does not follow you across sites.

6. Who receives it

We use other companies to run Holodeck. Each receives only what its job needs:

• Railway (United States): hosts the app and its database.
• Cloudflare (United States): serves our site, our domain’s addresses, counts visits to the site and forwards email sent to our support address.
• Zoho (European Union): keeps the mailbox where email to our support address arrives.
• Resend (United States): sends the emails the app sends, such as invitations.
• Paddle (United Kingdom): sells subscriptions as merchant of record, and is responsible on its own account for the payment data it collects, under its privacy policy.
• GitHub (United States): signs you in, if you choose it.
• Google (United States): signs you in, if you choose it.

Inside Holodeck, the members of your organization and of your projects see your name, your picture, what you wrote and what you and your agents did there.

We may share data with our professional advisers (lawyers and accountants) where they need it to advise us. We may disclose data when the law requires it, or to a company that takes over Holodeck, which would remain bound by this notice.

7. Transfers to other countries

Our providers store and process data outside Brazil and outside the European Economic Area, mainly in the United States. Where the law asks for a safeguard for these transfers, we rely on one the law accepts. You can ask us which one applies to your data.

8. How long we keep it

• Your account and your content: for as long as the account or the organization exists.
• What agents are doing: the detailed events for 7 days. The totals computed from them (time, tools used, failures) stay with the task and the agent.
• Backups: we back up the database regularly and keep each backup for up to 30 days.
• Deleted organizations and accounts: removed from the live service when deleted, and from backups within 30 days, when the last backup that contains them is deleted.
• Sign-in records: 6 months, kept even if the account is deleted in that time, then deleted.
• Technical logs: up to 90 days.
• Billing records: for as long as tax and accounting law requires.

9. Your rights

You can ask us to:

• confirm whether we hold data about you, and give you a copy;
• correct data that is wrong or out of date;
• delete your data, or stop using it for a purpose you object to;
• give you your data in a format you can take elsewhere;
• tell you who we shared it with.

Write to support@holodeck-tracker.com. We answer within 15 days. For content that belongs to an organization, we may need to pass your request to its owner.

You can also complain to your data protection authority: in Brazil, the Autoridade Nacional de Proteção de Dados (ANPD); in the European Union or the United Kingdom, the authority of the country where you live.

10. Security

Connections to Holodeck are encrypted. Agent tokens are stored hashed, not in readable form. Access to the production systems is limited to the people who need it to run the service. No system is perfectly secure: if a breach puts your data at risk, we will tell you and the authorities as the law requires.

11. Children

Holodeck is made for people at work and is not directed at anyone under 18. We do not knowingly collect data from children.

12. Changes to this notice

When we change this notice in a way that matters, we will tell the owners of organizations by email or in the app before the change takes effect. The date at the top of this page says when it last changed.