Privacy Policy
Effective September 25, 2026. Govlin captures operational metadata only. Source code never leaves your workstation.
No source code
Only metadata: SHA, branch, author, timestamp, file count.
Advisory signals
Signals are observations, not legal or HR determinations.
Org controls the data
Your employer is the data controller, not Govlin.
1. Scope and Controller
This Privacy Policy applies to the Govlin Desktop application and the Govlin server. It governs the collection, processing, and storage of operational metadata generated by developer workstations.
The data controller is the organization that deploys Govlin (your employer or the entity that licensed the software). Govlin (the software and its operators) acts as a data processor on behalf of the deploying organization.
Individual developers whose Git activity is monitored are data subjects under applicable data protection law (including GDPR where applicable).
2. Data Collected
Govlin captures operational metadata only. The Desktop sends these fields with each Git event it records:
| Field | Example | Purpose |
|---|---|---|
| event_type | commit, push | Identifies the Git operation |
| status / reason | success, blocked | Outcome of the operation and why it was blocked or failed |
| commit_sha | a3f8c2e… | Links event to a specific commit |
| branch | feat/KAN-42-login | Identifies the branch |
| user_login / user_name | alice / Alice Doe | GitHub login and Git author name |
| commit_message | feat: KAN-42 login | Links the change to the tickets it cites |
| files | src/auth/login.ts | Paths of staged files (paths only, never contents) |
| repo_full_name / org_name | org/repo | Repository and organization |
| device | hostname, windows, x86_64 | Computer name, operating system and architecture |
| timestamp | ISO 8601 | When the operation occurred |
| client_version | 0.2.13 | Desktop app version for compatibility |
What is never collected
Source code, file contents, diffs or patches, passwords, secrets, or any file data. Change impact analysis runs on the workstation and is not sent. No source code ever leaves the developer workstation.
3. Signals and Advisory Findings — Liability Limits
Govlin may generate non-compliance signals — automated observations that flag potential deviations from configured governance policies (e.g., a direct push to a protected branch, a commit outside configured working hours).
Important — Advisory Nature
- Signals are computational observations, not legal conclusions, HR decisions, or determinations of misconduct.
- A signal indicates that a configured policy rule may have been triggered. It does not establish intent, negligence, or fault.
- Signals may contain false positives due to configuration errors, clock skew, or incomplete context available to the system.
- Govlin provides no warranty — express or implied — as to the accuracy, completeness, or fitness of signals for any employment, disciplinary, or legal purpose.
- The deploying organization assumes full responsibility for any decision made on the basis of a signal, including HR actions, performance reviews, or contractual enforcement.
Govlin operators expressly disclaim liability for damages arising from decisions made on the basis of signal data, including but not limited to wrongful termination claims, reputational harm, or regulatory action resulting from misuse of signal output.
Organizations deploying Govlin are responsible for ensuring their use of signal data complies with applicable labor law, employment contracts, works council agreements, and data protection regulations in their jurisdiction.
4. Legal Basis for Processing
The deploying organization processes event metadata under one or more of the following legal bases:
- Legitimate interests: Monitoring development operations for security, compliance, and traceability purposes constitutes a legitimate organizational interest under Art. 6(1)(f) GDPR, provided it is proportionate and employees are informed.
- Legal obligation: Where applicable regulatory frameworks (SOC 2, ISO 27001, PCI-DSS) require demonstrable audit trails, processing may be necessary to comply with a legal obligation under Art. 6(1)(c) GDPR.
- Contract performance: Where the developer's employment contract includes provisions for system activity monitoring, processing may be grounded in Art. 6(1)(b) GDPR.
The deploying organization is responsible for establishing and documenting the applicable legal basis, notifying employees, and complying with any works council or collective bargaining requirements before deployment.
5. Data Retention and Security
Retention: Event records are stored for the duration configured by the deploying organization. Govlin does not impose a maximum retention period; the deploying organization is responsible for defining and enforcing data minimization policies consistent with their legal obligations.
Immutability: Audit event records are append-only. Records cannot be modified or deleted through the standard API. This design supports regulatory requirements for tamper-evident audit trails.
Encryption in transit: All communication between Govlin Desktop and the Govlin server must be secured with TLS in production environments. HTTP is supported for local evaluation only.
API key security: API keys are stored as SHA-256 hashes. The plain-text key is never persisted after initial issuance.
Access control: The Govlin server enforces role-based access. Developers can only access their own event records. Administrative data is restricted to Admin-role keys.
6. Data Subject Rights
Where GDPR or equivalent data protection law applies, individuals have the right to:
- Access — Request a copy of event records associated with their user login.
- Rectification — Request correction of inaccurate metadata (e.g., incorrect user_login attribution).
- Erasure — Request deletion of event records, subject to the deploying organization's legal obligations to maintain audit trails.
- Restriction — Request that processing be restricted pending resolution of an accuracy dispute.
- Portability — Request event data in machine-readable format via the
POST /exportendpoint. - Objection — Object to processing based on legitimate interests grounds.
Requests should be directed to the deploying organization's Data Protection Officer or HR department. Govlin operators can only fulfill data requests upon written instruction from the deploying organization acting as data controller.
7. Contact
For privacy-related inquiries regarding Govlin as software product, contact:
For requests relating to your personal data held by your employer via Govlin, contact your organization directly. Govlin operators cannot act on individual data requests without authorization from the deploying organization.
This policy may be updated periodically. Material changes will be communicated via the Govlin website. Continued use of the platform after changes are posted constitutes acceptance of the revised policy.