Privacy Policy

Who is responsible

CS DevSync is operated by Custify Solutions d.o.o. Beograd (Novi Beograd), Jurija Gagarina 32, Novi Beograd, Belgrade, Serbia (registration number 22160478, tax ID 115457336), reachable at info@custify.rs. We are the controller of the personal data described below. This notice is written to satisfy the EU GDPR and the Serbian Personal Data Protection Act (ZZPL).

The short version

• Your terminal sessions, the contents of your files and your screen are never sent to our servers. They travel directly between your browser and your own machine over your own Tailscale network.
• We store the minimum needed to know your machines exist and belong to you.
• No advertising, no tracking cookies, no data sale — ever. Our host collects basic, aggregate visit statistics for the website; details below.
• You can export everything we hold, or delete it all, from inside the app.

What we store

• Account — email address, an authentication credential (a password hash, or a Google account identifier if you sign in with Google), display name, creation and last-sign-in timestamps.
• Machines you connect — the name you give them, hostname, operating system, agent version, their address on your own Tailscale network, optionally a MAC address you enter yourself for Wake-on-LAN, power state (on mains / battery percentage), and when the machine last checked in.
• Activity records — a security log of privileged actions (a terminal opened, a file read or uploaded and its path, a wake request, a machine enrolled), with timestamps and which machine they concerned.
• Work-time records — start and end times of periods during which a project directory on your machine was in active use, and the project's folder name.
• Notifications — the text of notifications sent to you and, if you enable push, the push endpoint your browser vendor issues plus the browser identification string.
• Invitations — if you invite someone, their email address and any note you write.
• Preferences — per-project settings you enter, such as nicknames and links.

What we deliberately do not store

This product is built so that the sensitive part never reaches us. Terminal input and output, file contents, directory listings and the live browser view move directly between your browser and your machine over your Tailscale network, encrypted end to end. They are not proxied through, logged by, or stored on our servers. We also never receive your Tailscale credentials, your machines' local files, or the contents of the commands you run — only the fact that a session existed, in the activity log above.

Why we are allowed to store it

• Performance of a contract — account, machine and preference data exist to deliver the service you asked for.
• Legitimate interest — the activity log exists to let you and us detect misuse of remote access to your machines, which is a security necessity for a product of this kind.
• Consent — push notifications, which you switch on per device and can switch off at any time.

Who else processes it

• Supabase — database, authentication and server functions, hosted in the EU (Frankfurt, eu-central-1).
• Lovable — hosting and content delivery for the web application. Their platform also collects basic aggregate usage statistics for the site (page views and similar), served from our own domain. It is not advertising, it does not build a profile of you across other websites, and we do not sell or share what it collects.
• Google — only if you choose to sign in with Google, and only for authentication.
• Your browser vendor's push service (Apple, Google or Mozilla) — only if you enable push notifications; it receives the notification text in order to deliver it to your device.

Tailscale is your provider, not ours: you hold that account and the network it creates. We never see its credentials.

How long we keep it

Activity records are deleted automatically after 90 days. Everything else is kept for as long as your account exists.

Deleting your account deletes your account record, your machines, their credentials, your remaining activity log, your work-time records, notifications, push subscriptions and preferences. Deletion is immediate and cannot be undone; there is no hidden grace period in which we retain a copy. Backups held by our database provider roll off on their own schedule, at most 30 days.

Your rights

You may access, correct, export, restrict or object to the processing of your data, and have it erased. Two of these are built into the product and need no request: Profile → Export my data produces a machine-readable copy of everything we hold, and Profile → Danger zone deletes your data or your entire account. For anything else write to info@custify.rs; we answer within 30 days.

You also have the right to complain to a supervisory authority — in Serbia the Commissioner for Information of Public Importance and Personal Data Protection, or in the EU your national data protection authority.

Cookies and similar technology

We set no advertising cookies and build no cross-site profile, so there is no consent banner to click through. Your browser stores your sign-in session locally so you stay signed in, and the installed app caches its own files so it can start offline. Our host's aggregate visit statistics, described above, run on the site as well.

Security

Data is encrypted in transit. Every database table is protected by row-level security scoped to the owning account, so one customer's rows are unreachable from another's session. Machine credentials are stored only as hashes and are compared in constant time. Software updates delivered to your machines are cryptographically signed and each machine verifies that signature before running the update. No system is perfect: if we ever discover a breach affecting your personal data, we will notify you and the relevant authority as the law requires.

Children

The service is not intended for anyone under 16, and we do not knowingly collect their data.

Changes

If this policy changes materially we will say so in the app before the change takes effect. The date at the top always reflects the current version.