Privacy Policy

We collect the minimum needed to run your CI/CD pipeline.

• • SSH public keys — to authenticate git pushes (we store the fingerprint, key text, and your label)
• • Username — auto-generated from your SSH key on first push
• • Organization and project names — to organize your work
• • Session cookie — a signed cookie to keep you logged in
• • Source code — stored on disk as bare git repositories, used only for builds

Some things we never touch.

• ✗ Passwords — Zippy uses SSH-only authentication
• ✗ Build logs — streamed live to your terminal, then discarded
• ✗ Private keys — we never store or handle private keys
• ✗ Personal information sales — we never sell your data

Your data serves one purpose: to run your builds.

• → We use your SSH public key to authenticate you
• → We use your project name and source code to execute your build script
• → We use your email to contact you about your account (if needed)

We don't sell, share, or give your data to anyone else. Period.

Environment variables stay encrypted in your repository.

We never store secrets in our database. You encrypt them with GPG in your own repo. During a build, we decrypt them temporarily—just long enough to inject them into your build script. Then they're gone.

You own your data. You can control it.

• → Delete your account — removes all associated data
• → Remove SSH keys — revoke access anytime
• → Request data — see exactly what we have on you

Your source code and account data are stored on our servers. We take security seriously: encrypted connections, no unnecessary data copies, minimal external dependencies.

Zippy is self-hosted infrastructure. No third-party SaaS, no data brokers.

If you have privacy concerns or questions about your data, contact us at info@zippy.sh.