Privacy policy
Last updated: 9 November 2026
This policy explains how DiffCost ("we") handles personal data when you use diffcost.dev and the DiffCost service. For every field the GitHub Action sends and every value the service stores, see Security and data.
The short version#
- The DiffCost GitHub Action runs in your own GitHub Actions runner. Your SQL goes to BigQuery in your own Google Cloud project, and never reaches us.
- With an API key, the Action sends us numbers (costs, bytes and counts) and identifiers (the repository, pull request number and commit). It sends the pull request author's GitHub login only if your workflow turns on
send_author. - When you sign in, GitHub gives us your GitHub ID, login, email address and avatar.
- We don't sell personal data, show ads, or use analytics or tracking cookies.
Who is responsible#
DiffCost, based in New South Wales, Australia, is responsible (the "controller") for the personal data described here. Contact: support@diffcost.dev.
What we collect#
When you sign in with GitHub: your GitHub user ID, login, email address and avatar URL. We also ask GitHub which organizations you belong to and whether you're an owner there (the read:org and user:email permissions), to link you to your organization and set your DiffCost role. We store your ID, login, email address, avatar URL, role, the date you joined and the time of your last sign-in. Your login, email address and avatar are refreshed from GitHub each time you sign in.
From the GitHub Action, only with an API key: for each run, the repository name, pull request number and commit SHA, and the costs, bytes and counts. The pull request author's GitHub login is sent only when your workflow sets send_author: true. The Action never sends SQL, table or column names, file paths or row data.
About your organization: its GitHub login and ID, the DiffCost GitHub App installation ID, thresholds and Slack webhook URLs, pricing settings, API key details (the keys themselves are stored only as hashes) and billing identifiers.
Audit log: sign-ins, API key changes, threshold and settings changes, member changes, blocked pull requests and plan changes, with the person who made each change. Each sign-in entry includes a keyed hash of your IP address. The stored value doesn't reveal the address on its own, but we can match it to an IP address we already know, so it's pseudonymous, not anonymous.
Request logs: our hosting provider, Google Cloud, logs every request to diffcost.dev, including your IP address, browser user agent, the URL and the time. We use these logs to run and protect the service.
Payments: Stripe collects your card and billing details in Stripe Checkout; they never reach our servers. We store the Stripe customer and subscription IDs, and we can see the billing email address and the other details you gave Stripe in our Stripe account. If you buy through Google Cloud Marketplace, we store the Marketplace account and entitlement IDs.
Email you send us: if you write to support@diffcost.dev, we keep the conversation.
Cookies#
diffcost.dev sets only the cookies it needs to work, and loads no third-party scripts:
| Cookie | Purpose | Lasts |
|---|---|---|
session |
Keeps you signed in to the dashboard | 72 hours, or until you sign out |
csrf_token |
Protects dashboard actions against cross-site request forgery | 72 hours |
oauth_state |
Protects the GitHub sign-in against forgery | 10 minutes |
login_next |
Takes you back to the page you asked for after you sign in | 10 minutes |
org_picker |
Holds your choice while you pick an organization at your first sign-in | 10 minutes |
gcp_mp_signup |
Carries a Google Cloud Marketplace sign-up to the linking page | 15 minutes |
There are no analytics, advertising or tracking cookies.
How we use your data, and why#
| Purpose | Data | Legal basis (EEA and UK) |
|---|---|---|
| Provide the service: sign-in, dashboard, merge blocking, Slack alerts | Account, organization and Action data | Performing our contract with you or your organization |
| Apply plans and seats, and bill | Organization and billing data | Performing our contract |
| Protect the service: audit log, rate limits, abuse prevention | Audit log, request logs, keyed IP hashes | Our legitimate interest in keeping the service and its customers secure |
| Answer support requests | Your email and what you send | Our legitimate interest in helping you, or our contract |
| Keep financial records | Billing data | Legal obligation |
We don't use personal data for advertising, and we don't make automated decisions about you that have legal or similarly significant effects.
Who we share it with#
These providers process data for us:
| Provider | What for | Where |
|---|---|---|
| Google Cloud | Hosting, database, logs and secrets | United States (Iowa) |
| GitHub | Sign-in, and posting commit statuses on your repositories | United States |
| Stripe | Payments and invoices | United States and other countries |
| Cloudflare | DNS, and forwarding mail sent to support@diffcost.dev | Worldwide network |
| Google (Gmail) | The support mailbox | United States |
| Resend | Sending our replies from support@diffcost.dev | United States |
| Google Cloud Marketplace | Billing, only if you buy through it | United States |
Slack alerts go to the Slack webhook that your admins configure, so they're delivered to your organization's own Slack workspace. An alert names the repository, links to the pull request and gives the cost increase and the block reasons.
We also disclose data when the law requires it, and to a buyer of the business, who would have to keep this policy's commitments.
Where your data is stored#
The service runs on Google Cloud in the United States (us-central1, Iowa). If you use DiffCost from outside the United States, your data is transferred to and processed in the United States. For personal data from the EEA or the UK, these transfers rely on the European Commission's Standard Contractual Clauses (with the UK's addendum to them) in our providers' data processing terms, such as those of Google Cloud, Stripe, GitHub and Cloudflare.
How long we keep it#
- Account, organization and run data: until an admin asks us to delete the organization's data. The dashboard's history window limits what it shows; it doesn't delete anything.
- Request logs: 30 days.
- Database backups: 7 days, so deleted data is gone from backups 7 days after it's deleted.
- Billing records: as long as tax and accounting law requires. Stripe keeps its own records under its own policy.
- Support email: as long as we need it to deal with your request and any follow-up.
Your rights#
You can ask us to give you a copy of your personal data, correct it, delete it, or restrict or object to how we use it. Email support@diffcost.dev from the email address on your GitHub account. We answer within 30 days.
- If we delete your account, we delete your user record, and remove your GitHub login and IP hashes from the audit log and the run history. The entries themselves stay, so your organization's history stays complete.
- Your organization's data (thresholds and run history) is managed by its admins, so we act on an admin's request for it.
- If you're in the EEA or the UK, you can also complain to your data protection authority.
Security#
All traffic uses HTTPS, API keys are stored only as hashes, and dashboard pages are protected against cross-site request forgery and framing. Security and data has the details.
Children#
DiffCost is a tool for businesses. We don't knowingly collect data from anyone under 16.
Changes to this policy#
We'll post any update on this page with its date. For a material change, we'll give organization admins at least 30 days' notice.
Contact#
DiffCost, New South Wales, Australia. Email: support@diffcost.dev.