Privacy policy

Version 1, effective 4 September 2026. This covers the AuditFellow website, the account area, the Claude Code plugin and the command line tool.

1. The short version

What you write to your AI agent and what it answers never pass through AuditFellow. The plugin installs your team's methodology on your machine as a skill the agent reads; the request goes, as always, to the AI platform your organization uses, and AuditFellow is not in that path.

2. What the plugin and the command line tool collect

• Your key, stored in a file on your device (~/.auditfellow) with restricted permissions.
• A random device identifier and a device name, sent with the daily key check so the key can be bound to one device.
• Nothing else. No page content, no browsing history, no requests, no answers, no analytics.

Permissions: "storage" keeps the key and the pack on your device; "alarms" schedules the daily check; the host permissions cover only the AuditFellow servers and the three chat sites where the methodology is added.

3. What the website and account area store

• Account details: name, work email, password hash, organization, role, and how you heard about us.
• Organization data: members and roles, keys (hashed, and encrypted so an admin can show them again), one daily check per key (time, device name, result).
• Billing status from our payment provider (plan, subscription state, renewal date). Card details never reach us; the provider, acting as merchant of record, holds them.
• Website usage: pages, visits, referrer, country and device type. The public pages of this website (home, pricing, sign-up) carry the Google Ads tag, which sets Google cookies to measure whether a visit from one of our ads led to a sign-up. The app pages and the extension carry no advertising tag and no analytics.
• Messages you send us through the contact form or the in-app Contact page.

4. The team methodology

Corrections your reviewers make become distilled rules. Your organization chooses where they live: on each device only, in AuditFellow's storage (encrypted on your devices before it reaches us, so we hold ciphertext), at an endpoint your company runs, or in a Google Drive folder you share with us. You can export or delete them at any time.

5. What we do not do

• We do not sell data and we do not share it with advertisers.
• We do not use your content to train models.
• We do not read your requests or answers; we cannot, because they do not reach us.

6. Providers

Hosting and database: Cloudflare. Payments and invoices: Lemon Squeezy (merchant of record). Transactional email: our email provider, for key delivery, trial notices and replies. Sign in with Google uses Google's OAuth; we receive your name, email and profile picture.

7. Retention and deletion

Account and organization data are kept while the account exists. When an organization is closed, its stored methodology is available for export for thirty days and is then deleted. Daily key checks are kept for ninety days. You can ask for deletion of your account through the contact form.

8. Your rights and contact

You can ask what we hold about you, correct it or delete it. Questions and requests go through the contact form or the Contact page inside the app.