Privacy Policy

Cachely is currently operated by its maintainers as a beta and is not yet incorporated. The maintainers act as the data controller for the information described below. For any privacy question, request, or complaint, email hello@cachely.dev. We aim to reply within five business days.

Information we collect

We collect only what we need to run the service, respond to people who contact us, and evaluate voluntary product feedback.

• Account data. When you sign in to the dashboard via Google or GitHub, we receive your email address, display name, and that provider’s account ID. We never receive your password and do not request access to any other data held by the provider. Account welcome and invitation emails include a blind copy to our internal team inbox to help with onboarding and support.
• Cache data. Build artifacts that you or your CI direct a configured cache client to upload, together with their content-addressed hashes, file paths, task output and metadata included in the artifact, your workspace identifier, and the API token identifier that wrote them. We do not independently connect to, clone, or scan your source repository. We receive only what your configured build and caching tools send to the Service at your direction.
• Operational logs. Cache events (hit, miss, put), timestamps, byte counts, and the token identifier that produced them. We use these to bill, to debug, and to detect abuse.
• Interest and contact forms. Name, email, company, and any free-text message you submit through forms on this site (for example, the beta access form) or send by email. We use this only to reply to you.
• Compatibility research. If you submit the older Nx interest form, we store your Nx version, cache solution, upgrade blocker, managed-cache interest, team-size range, optional email, signed-in status, source page, and referring site (without its path or query). We use these responses to evaluate demand and may contact you about the research if you provide an email. We email a copy to our internal team inbox for review; there is no automated reply or mailing-list enrollment. Cloudflare uses a temporary hashed network identifier to limit abuse of this form; we do not store IP addresses in research submissions.
• Integration research. If you request an integration, we store the requested tool, biggest challenge, optional caching approach, team-size bracket, interest level, additional context, submission timestamp, allowlisted campaign slugs and referring hostname (without paths, queries or credentials). An optional email is stored only with explicit contact consent, which is required for pilot or update requests. We use these responses to prioritize research and contact you only as agreed. We email a copy to an internal Cachely team inbox for review. No automated emails to you or mailing-list enrollment follow a submission. Cloudflare processes a temporary hashed network identifier to rate-limit this form; we do not store IP addresses in research submissions.
• Server logs. Standard request metadata (IP address, user agent, URL, timestamp, response status) is processed by Cloudflare on our behalf for security and reliability. These logs are short-lived.

How we use it and our legal basis

• To provide the service and workspace insights (account data, cache data, operational logs): performance of a contract, or our legitimate interest in running the service you asked us to run.
• To reply to you (forms, email): our legitimate interest in answering inbound requests, or your consent when you initiate contact.
• To evaluate compatibility needs (voluntary research forms): our legitimate interest in understanding requested product improvements. Contact about integration research is based on your explicit consent, which you can withdraw by emailing us.
• To keep the service safe (server logs, abuse detection): our legitimate interest in security and integrity.
• For optional analytics (Google Analytics 4): your consent, freely given via the banner and revocable at any time.

Artifact processing and support access

• Automated processing may read limited artifact structure, file paths, cache metadata, and task-output prefixes to derive project, target, tool, file-count, size, duration, and similar labels for the insights shown to authorized members of your workspace.
• Authorized maintainers may access the minimum necessary cache data to investigate a service problem, respond to a support request, protect the Service, or debug incorrect insight classification. Access is limited to those operational purposes.
• Customer-specific artifacts, contents, and derived insights are not published or made available to other customers.

What we do not do

• We do not sell your personal data.
• We do not share your data with advertisers or data brokers.
• We do not independently access your source repository or collect files outside the cache data your configured tools send.
• We do not use cache artifacts or derived insights for advertising, competitive research, public disclosure, or model training.
• We do not add you to a marketing list because you filled in a form.

Sub-processors

We use a small number of vendors to run the service. Each one is contractually bound to handle data on our behalf only.

• Cloudflare, Inc. - hosting (Workers, D1, R2), form-notification email delivery, CDN, DDoS protection, and Cloudflare Web Analytics. Cloudflare may process data in any of its global regions.
• Google LLC - sign-in (Google OAuth) for the dashboard, and Google Analytics 4 on the marketing site and dashboard (only when you consent).
• GitHub, Inc. - sign-in (GitHub OAuth) for the dashboard, for people who choose that provider.

Analytics on this site

We use Cloudflare Web Analytics to count page views and referrers and to measure page-load performance. It is cookie-free, does not fingerprint visitors, and runs for every visitor.

We optionally use Google Analytics 4 to understand which pages and calls to action help people decide to try Cachely. After consent, GA4 receives a sanitized page URL, page title, referrer, broad device and browser details, and events for calls to action and successfully submitted interest forms. On the dashboard, we measure completed website signups and the first cache hit observed during the following 30 days. These events use a fixed page label; dashboard paths and OAuth parameters are excluded. A browser-local marker prevents repeat events for the same account. Your consent choice is shared between the marketing site and dashboard. For the optional older Nx research form, consented analytics also includes your Nx version, categorical answers, and signed-in status. We do not send email addresses, free-text form responses, account identifiers, workspace identifiers, or cache contents to GA4. Integration request answers and contact details are not sent to client-side analytics. GA4 sets cookies and is only loaded after you explicitly grant consent in the banner. You can change your mind at any time:

Allow analytics cookiesReject analytics cookies

International transfers

Our vendors are US-headquartered and operate globally. Where data is transferred out of the EEA or UK, the transfer is covered by the relevant vendor's Standard Contractual Clauses and supplementary safeguards.

Retention

• Managed cache artifacts currently auto-expire 20 days after upload. An artifact still in use may be uploaded again by your cache client.
• Operational logs and derived insight records are retained while your workspace is active.
• Account data is retained while your account is open.
• Form submissions and inbound email are retained for up to 24 months unless you ask us to delete them sooner.
• Server logs are retained for a short rolling window for security and debugging.

Your rights

Subject to applicable law (including the GDPR and UK GDPR for users in the EEA and UK, and the CCPA for residents of California), you have the right to access, correct, export, restrict, or delete your personal data, to withdraw consent where processing is based on consent, and to lodge a complaint with your local supervisory authority. To exercise any of these rights, email hello@cachely.dev from the address tied to your account.

Deletion

Email us at hello@cachely.dev from the address tied to your account and we will purge your workspace within 30 days, except where we are legally required to keep specific records (for example, billing records).

Security

We use TLS in transit, encrypted storage at rest via our hosting provider, and scoped API tokens for cache access. No system is perfectly secure; if you believe you have found a vulnerability, please email hello@cachely.dev and we will respond promptly.

Children

Cachely is intended for software developers and is not directed at children under 16. We do not knowingly collect data from children.

Changes

We will update the "Last updated" date at the top of this page when this policy changes. Material changes will also be announced in-product or by email to active workspace owners.