Cotterpin Technologies Ltd · Data Retention Policy · Version 1.2 · https://cotterpin.io/legal/data-retention.html
Legal
Data Retention Policy
For each kind of data: where it lives, how long it is kept, and how it is deleted.
The short version
- Most of what Cotterpin creates stays on your machine, where you control how long it lasts.
- What reaches us is small, and each kind has a retention period below.
- When a period ends, the record is deleted — automatically where the service can do it, otherwise by a scheduled review.
1. What this policy covers
This policy sets out, for each kind of data Cotterpin Technologies Ltd holds or creates, where it lives, how long it is kept and how it is deleted. It supports our Privacy Policy and GDPR Statement. We review it at least once a year and whenever what the software sends changes.
2. Data held by our licence service
The licence service runs on Amazon Web Services in eu-west-1 (Ireland). Records live in Amazon DynamoDB; signing keys live in AWS KMS and are not personal data.
| Data | Where | Kept for | How it is deleted |
|---|---|---|---|
| Licence record: licence id, plan, seats, status, paid-through date, hashed customer email | DynamoDB | While the licence exists, then 12 months after it ends (cancelled, lapsed or refunded) | Deleted by us in a monthly review of ended licences |
| Machine fingerprints bound to a licence | DynamoDB | Until you remove the machine (cotterpin machines remove) or the licence record is deleted | Removed by the command; otherwise with the licence record |
| Machine change audit records (add, move, remove) | DynamoDB | With the licence record: 12 months after the licence ends | Deleted with the licence record |
| Team single sign-on members: the identity provider's identifier, email address, machines and administrator or revoked status | DynamoDB | While the Team licence exists, then with the licence record | Deleted with the licence record |
| Single sign-on settings: the provider's address and client id (in DynamoDB) and its client secret | DynamoDB; the secret in AWS Secrets Manager | While the Team licence exists | Deleted with the licence record |
| Sign-in records holding a provider token while a machine signs in | DynamoDB | Until the machine collects the token; an uncollected one stops working after 10 minutes | Cleared when collected; otherwise expire automatically about an hour later (DynamoDB time-to-live) |
| Machine registrations (one per machine fingerprint), and trial records made before 28 October 2026 | DynamoDB | 24 months after the record was made | Deleted by us in a monthly review |
| One-time claim codes (stored only as a hash) | DynamoDB | A code works for 15 minutes; its record expires after 30 minutes | Expire automatically (DynamoDB time-to-live, which deletes an expired record normally within a few days) |
| Bug reports you send, from the next release, which brings sending them, and those sent automatically where you turned that on for a repository and kind, from the next release (versions, the internal error's type and Cotterpin frames, the fixed fields of a fault in Cotterpin's own working, reduced refusal records and your description; linked to your licence id, or anonymous — see the Privacy Policy) | DynamoDB | Until the fault is closed, then 12 months | Expire automatically (DynamoDB time-to-live, set when the report is closed) |
| Founding Developers applications (the form's answers and your email address) | DynamoDB | Until the programme ends for you; if you are not offered a place, 3 months after the cohort you applied for fills | Deleted by us at the end of the period, or sooner if you ask |
| Applied Paddle notification ids (to refuse replays) | DynamoDB | 35 days | Expire automatically (DynamoDB time-to-live) |
| Rate-limit counters: a one-way hash of the source IP address (or of the email address, for claim requests) and a count per hour. The address itself is not stored, but we still treat the hash as personal data | Licence service (DynamoDB) | 2 hours | Expire automatically (DynamoDB time-to-live) |
| Service logs (AWS Lambda / API Gateway). The request log holds a request id, time, route, status and response time only: no IP address, identity, header or request content. The service log holds only the stage and error code of a failure | Amazon CloudWatch Logs | 30 days | Log-group retention setting |
3. Data held for the business
| Data | Where | Kept for | How it is deleted |
|---|---|---|---|
| Orders, invoices, payments and refunds | Paddle (merchant of record); any copies we export | As tax and accounting law requires, 6 years from the end of the financial year they relate to, as HM Revenue & Customs requires | Paddle under its own policy; our copies deleted at the end of the period |
| Support emails | Our support mailbox, with our email provider | 2 years after the conversation ends | Deleted from the mailbox at the end of the period |
| Security reports | security@cotterpin.io mailbox | 2 years after the report is closed | Deleted from the mailbox at the end of the period |
| Email correspondence | Our mailboxes, with Microsoft 365 | 2 years after the conversation ends, unless it forms part of a contract or accounting record kept longer above | Deleted from the mailbox at the end of the period |
| Claim emails we send (one-time codes) | Amazon SES, from licences@cotterpin.io | We keep no copy of the message, and we have set up no sending log, event record or archive for it | — |
| Website request logs | Microsoft Azure Static Web Apps | As Microsoft keeps them for security, under its own retention rules; we do not receive or store them | By Microsoft |
| Data protection requests and our replies | privacy@cotterpin.io mailbox | 2 years after the request is closed | Deleted from the mailbox at the end of the period |
4. Data that stays on your machine
We cannot see or delete these; you control them.
| Data | Where | How long |
|---|---|---|
Your licence token (licence.json) | Your user configuration directory, readable only by you | Valid for at most 35 days, renewed online; delete the file to remove it |
Your consent answers (consent.json) | Your user configuration directory | Until you change them or delete the file |
| Run progress and spend; Watch reports; audit reports | Inside your repository's own Git directory, never tracked | Until you delete them; cotterpin clean removes leftovers from finished runs |
| Session reports and receipts | Your repository | Under your version control |
| The agent tool adapters you install, and a record of each install | Each agent tool's own user folder (for example ~/.claude/skills/cotterpin); the records in your user configuration directory | Until cotterpin adapters uninstall or cotterpin --uninstall takes them back |
| Guarded sessions (one empty file per agent session that worked in a repository set up with Cotterpin) | Your user configuration directory | Files older than 14 days are removed once there are more than 512; cotterpin --uninstall removes them all |
| Bug reports Cotterpin prepared, and the outbox (a copy of every report sent automatically, where you turned that on, from the next release) | Your user configuration directory, readable only by you | Until you send or discard a prepared report, or delete the files; the outbox is never sent anywhere |
| Cached releases and build cache | Cotterpin's per-machine cache | Capped by size; cotterpin cache gc or cache clear removes them |
5. Data we never hold
Your source code, diffs, prompts, agent transcripts, test output, file paths, repository names, provider API keys and the results of machine measurements never reach us, so there is nothing for us to retain or delete.
6. Deleting earlier
You can ask us to delete your data before its period ends (see the GDPR Statement). We will, unless we must keep it by law or to establish or defend a legal claim — in which case we will tell you what we are keeping and why.