Privacy policy

Effective [to fill in: the date this takes effect].

Docket is a task board for coding agents. It is operated by [to fill in: who operates Docket, a name or a company]. To ask about anything on this page, or about your data, write to [to fill in: a contact address].

This policy covers three things: the app at app.usedocket.dev, the adapter @usedocket/mcp that runs on your machine, and this site, usedocket.dev.

The short version

Docket stores what it needs to run your board: your GitHub login, your cards, and the record of what happened to them.
Docket is never sent the contents of a file, and never asks GitHub for access to a repository.
What is on your board may be used to train models: your cards, your notes, your agents’ reports, and the record of what happened to each card. Your code cannot be, because Docket never has it.
If you subscribe, Stripe takes the payment. Docket never sees your card.
Your data is not sold, and not used for advertising.
You can delete your account, and everything in it, yourself and at any time. Two things are not undone by that: backup copies, and training that has already happened. Both are described below.

What Docket collects

You sign in with GitHub. Docket asks GitHub for one permission, read:user, and reads three things from your profile:

your GitHub user id,
your GitHub login,
your public email address, if you have set one.

They are read again each time you sign in. If you later remove the public address from your GitHub profile, Docket keeps the last one it read.

The email address is shown to you on the Account page. Docket does nothing else with it.

Docket does not keep the token GitHub issues. It is used once, to read your profile, and discarded.

Your account also records when it was made.

As you use Docket

Projects. One for each repository: a name, a short key, the repository’s address (such as github.com/acme/billing-api), and the project’s settings.
Cards. Everything written on a card: its title, goal, constraints, scope and acceptance command, with its status, version, feature and dependencies, and the paths of the files it names or takes.
Claims. Which coding agent held a card and when, and the commit and branch the work started from. An agent is recorded as a label: the name of your client and four random characters.
The log. One entry for everything that happens to a card, with who did it and when. A note’s entry holds the note. A finish’s entry holds the agent’s report and the git facts listed below.
API keys. For each key: a hash of it, its first eight characters, its label, and when it was made, last used and deleted. Never the key itself.

You pay on Stripe’s checkout page, not on Docket’s. What you enter there goes to Stripe and not to Docket: your card, an email address, your billing address, and a name and tax id if you give them. Docket never sees or stores a card number. Stripe uses your address to work out the tax due.

Docket tells Stripe one thing about you: your account’s id inside Docket, a random code, so that a payment can be matched to your account. Nothing from your board goes to Stripe.

Docket keeps, for your account:

Stripe’s id for you as a customer;
the state of your subscription, such as on trial, active, a payment that failed, or ended;
the date the current period ends, and whether the subscription is set to end then;
which plan it is on;
whether the operator has given the account free use.

Docket sends no email of its own, with one exception: notice about your subscription that the terms require, such as a change of price, sent to the email address you gave at checkout. Stripe sends its own emails about payment, such as a reminder before a trial ends and word of a payment that failed.

What the adapter sends

The adapter sends something only when your coding agent calls one of its tools. Each call carries:

the tool’s arguments, exactly as your agent wrote them. If the agent gives the path of the folder it is working in, that path is among them;
seven facts about the repository: its address, owner and name, the commit and the branch that are checked out, whether there are uncommitted changes, and whether the folder is a git worktree;
a label for the agent.

Claiming and finishing a card add more facts read from git: commit ids, branch names, whether the work is committed and pushed, the names of the files that changed, the card references found in commit trailers, and the address of the pull request if there is one. To learn whether finished work has been merged, the adapter also sends card references with the ids of the commits that name them.

Every field is listed, by name, in the docs: What leaves your machine.

Not sent: the contents of any file, any diff, commit messages, the output of any command, your prompts, your agent’s replies, or your model provider’s key.

What your agent writes is kept as written. If it puts code, a secret, or someone’s personal details into a card, a note or a report, Docket stores that. Docket does not look for such things or remove them.

When your browser or your agent reaches the app

Railway, which hosts the app, records each request made to it: the time, the address requested, the result, the IP address the request came from, and the name of the browser or client that made it. Railway keeps these records for a limited time that it sets.

Docket’s own code does not write your IP address to its database.

Docket’s own logs hold errors, each with the message that caused it, and, when an account is deleted, a count of what was removed without saying whose it was. Card contents and tool calls are not written to the logs as Docket runs. While a fault in signing in is being investigated, the headers of sign-in requests may be logged as well. They include the IP address, and never a cookie or a credential.

What it is used for

To run the service: to show you your board, to give your coding agent its next card, to keep agents out of each other’s files, and to keep the service working.

And for one thing more:

It may be used to train models. What is on your board may be used to train and improve models for Docket: the text of your cards, notes and reports, and the record of what happened to each card. There is no setting to turn this off. Your code, your prompts and your agent’s replies cannot be part of it, because Docket is never sent them.

Two things it is not used for:

It is not sold, and it is not given to anyone for their own use.
There is no advertising, in the app or on this site.

Docket’s servers call two outside services: GitHub, when you sign in, and Stripe, if you subscribe, with what If you subscribe lists and nothing from your board. If training a model ever means giving your data to another company, that company is added to Who else handles your data before it happens.

What your coding agent sends to the company that provides its model is between you and that company.

Cookies

The app, app.usedocket.dev, sets three:

docket_session keeps you signed in. It lasts 14 days, is sent only to app.usedocket.dev, and cannot be read by scripts.
theme holds your choice of light or dark. It lasts a year, and is set only if you choose one.
docket_oauth_state lasts ten minutes while you sign in with GitHub. It is how Docket knows that the sign-in coming back is the one you started.

This site, usedocket.dev, sets no cookies. It keeps your choice of light or dark in your browser’s local storage, which is not sent anywhere.

Stripe’s checkout page, and the page where you manage a subscription, are Stripe’s. They set Stripe’s own cookies, under Stripe’s privacy policy.

Who else handles your data

Railway hosts the app and its database, in the United States. Everything Docket stores is there. Railway’s privacy policy.
Stripe takes payment, if you subscribe, and works out the tax due. It holds your card and what you enter at checkout, and keeps records of your payments as the law requires of it, under its own policy. Stripe’s privacy policy.
GitHub signs you in, so GitHub knows that you use Docket. Docket sends GitHub nothing about your cards. GitHub’s privacy statement.
Cloudflare serves this site and counts visits to it with Cloudflare Web Analytics, which uses no cookies and nothing else kept in your browser. Cloudflare says it does not fingerprint individual visitors. Like any web host, it sees the IP address of a request. Cloudflare’s privacy policy.
npm serves the adapter when your client downloads it, and sees that download. npm’s privacy policy.

Your data is given to no one else, unless the law requires it.

If you use Docket from outside the United States, your data is sent to the United States and stored there.

How it is protected

Every table that holds your data is closed, in the database itself, to every account but yours.
A key is stored only as a hash made with a secret that is not in the database. A copy of the database alone would not give anyone a working key.
The session cookie is signed, and connections to the app are encrypted.

The docs say how each of these works: Security and data.

How long it is kept

Docket deletes nothing because of its age unless you ask it to. What you put on your board stays until you delete your account.

A card you delete is hidden. It stays in the database, with its log, until the account is deleted, or until you remove old cards.
Removing old cards, on the Account page, deletes for good the finished, abandoned and deleted cards that have not changed for at least 30 days and that no open card depends on, with their log.
A key you delete stops working at once. Its hash and label stay, marked deleted, until the account is deleted.
If you stop paying, or your trial ends without a subscription, your board is kept as it was until you delete the account. Docket refuses to work for it meanwhile, but paying again brings everything back, and you can download it or delete it from the Account page at any time.

Deleting your account

Account → Delete account shows a count of what will go and asks you to type your GitHub login. It then removes your account and everything under it from the database, at once: your projects, cards, dependencies, file paths, features, claims, the whole log, every key, and the login and email address Docket holds for you. Your keys stop working at that moment. It cannot be undone.

If you subscribe, deleting your account also deletes you as a customer at Stripe, which ends the subscription at once. Nothing more is charged. Stripe keeps its own records of payments already made, as the law requires of it.

Signing in again afterwards starts a new, empty account.

Once your account is deleted, your board is no longer in the database to be used for training. Training that has already happened is not undone: a model cannot be made to forget what it was trained on.

Docket holds no GitHub token, so there is nothing of yours for it to revoke at GitHub. To take Docket off the list of apps you have authorized, use your GitHub settings.

Backups

Copies of the whole database are taken so that the service can be put back after a fault. They are kept by the operator, away from Railway. A copy holds everything the database held at the moment it was made.

Deleting your account does not reach into copies that already exist. Your account stays in each copy made before you deleted it, for as long as that copy is kept. If the database ever had to be put back from such a copy, your account would come back with it.

How long a copy is kept: [to fill in: how long backup copies are kept].

Your choices

To see or correct what Docket holds. Your login and email address are on the Account page, and they come from GitHub: change them there and sign in again. For a copy of everything on your board, use Download your data on the Account page. To have something corrected, write to the address at the top of this page. What Stripe holds, you can see and change on the Billing page, through Stripe.
To delete it. Delete your account, as above.

Depending on where you live, the law may give you further rights over your data. To use one, write to the same address.

Changes to this policy

When this policy changes, the new one is posted on this page with a new date. A change to what Docket collects, or to who handles it, is posted before it takes effect.