Privacy Policy

Account Information

When you authenticate with Microsoft Entra ID (Azure Active Directory), we collect:

• • Email address - Used as your unique identifier
• • Display name - For personalization
• • Profile picture - If available from Microsoft
• • Microsoft subject identifier - For authentication

Azure DevOps Connection Data

When you connect Azure DevOps workspaces to generate deployment briefs, we collect and store:

• • Personal Access Tokens (PATs) - Encrypted and securely stored to access Azure DevOps APIs
• • Workspace names and projects - To identify which data sources to query
• • Connection metadata - Creation date, last used, validation status

Azure DevOps Retrieved Data

When generating deployment briefs, we retrieve the following data from Azure DevOps (not permanently stored unless part of a saved brief):

• • Work items - Titles, descriptions, types, states, assignees
• • Pull requests - Titles, descriptions, reviewers, merge dates, repositories
• • Pipeline information - Build numbers, release names, deployment stages, dates
• • Test results - Test names, pass/fail status, execution times, test suites
• • Code coverage metrics - Line coverage percentages, uncovered code locations

Note: This data remains in Azure DevOps and is only retrieved temporarily to generate briefs. Generated briefs (markdown content) are stored in our database.

Generated Content

When you generate and save deployment briefs, we store:

• • Brief content - Markdown-formatted deployment documentation
• • Brief metadata - Title, creation date, pipeline information, template used
• • Custom templates - Your template configurations and customizations
• • Pipeline presets - Saved pipeline configurations for quick access

API Keys

For CI/CD integration, when you generate API keys:

• • API key hashes - Securely hashed (never stored in plain text)
• • Key metadata - Name, scopes, creation/expiration dates, last used date

Usage and Diagnostic Data

We automatically collect certain information to improve our service:

• • Session information - Login timestamps, session duration, IP addresses
• • Usage metrics - Number of briefs generated, features used, API calls
• • Error logs - Application errors, performance issues (no personal data)
• • Browser/device information - User agent, browser type, operating system

Contact Form Submissions

When you use our contact form, we collect your name, email, subject, and message content. These submissions are logged for support purposes.

Data Storage

• • Database: PostgreSQL database for user accounts, briefs, templates, and metadata
• • Location: Cloud infrastructure with data redundancy and backups
• • Retention: Data is retained while your account is active. See "Data Retention" below

Security Measures

We implement industry-standard security measures to protect your data:

• • Encryption in Transit: All data transmitted between your browser and our servers uses TLS 1.3 encryption
• • Encryption at Rest: Sensitive data (PATs, API keys) is encrypted using AES-256 encryption
• • Password Hashing: API keys are hashed using bcrypt with high work factors (never stored in plain text)
• • Session Security: HTTP-only, secure session cookies with expiration (7 days default)
• • Access Control: Workspace-scoped data access with role-based permissions
• • Rate Limiting: API rate limiting and request throttling to prevent abuse
• • Monitoring: Continuous security monitoring and logging with OpenTelemetry

Data Retention

• • Active Accounts: Data is retained while your account is active
• • Deleted Accounts: Upon account deletion, all personal data and briefs are permanently deleted within 30 days
• • Legal Requirements: Some data may be retained longer to comply with legal obligations (e.g., transaction records)
• • Anonymized Analytics: Aggregated, anonymized usage data may be retained indefinitely for analytics

International Data Transfers

DeployBrief operates globally. If you access our service from outside the region where our servers are located, your data may be transferred across international borders. By using DeployBrief, you consent to such transfers. We ensure appropriate safeguards are in place to protect your data in accordance with this privacy policy.

Children's Privacy

DeployBrief is not intended for use by individuals under the age of 16. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.

Cookies and Tracking

DeployBrief uses the following cookies:

• • db_session - Essential session cookie for authentication (HTTP-only, secure, 7-day expiration)
• • oauth_state - Temporary OAuth flow validation (HTTP-only, secure, 10-minute expiration)

We do not use third-party tracking cookies or advertising cookies. Essential cookies are required for the service to function and cannot be disabled.

Changes to This Privacy Policy

We may update this privacy policy from time to time to reflect changes in our practices or legal requirements. We will notify you of significant changes by:

• • Updating the "Last Updated" date at the top of this page
• • Sending an email notification to your registered email address
• • Displaying a prominent notice in the application

Your continued use of DeployBrief after changes become effective constitutes acceptance of the updated policy.