Privacy
What Sinter stores about you, why, and for how long. Written for people, not lawyers. Last updated 2026-09-30.
What we store
- Waitlist: the email address you leave on the landing page and when you left it.
- Account: your email address, when it was confirmed and when you last logged in. There are no passwords: you log in with a link we email you.
- Organizations: the name and slug of each organization, who belongs to it and with which role, and the invitations sent from it (the invited address, who invited them, the expiry). Login links and invitation links are stored hashed.
- GitHub: when an owner connects GitHub, the account the Sinter Lab App is installed on and the repositories it grants: their names, ids, default branch and whether they are private or archived. Never their code. Disconnecting uninstalls the App.
- Audit trail: a record of security-relevant actions: logins from invitations, membership and role changes, invitations sent, accepted or revoked, and platform admins opening an organization they do not belong to. Each record names the action, who did it, the organization, the time, and, when the action came from a browser, the IP address and browser user agent.
- Test history: what CI uploads for a repository with Temper: each test's module and name, file and line, whether it passed, and the commit, branch and CI run it ran in. For failed tests, the failure kind and message (Temper can leave messages out with --scrub-messages), stored up to a limit per run (200 failures by default). Per commit, which tests passed and which failed. A catalog of each repository's tests (module, name, file and line), and a log of uploads (when, sizes and counts). Never your source code. Upload tokens are stored hashed, and creating, revoking and deleting uploaded data are recorded in the audit trail.
We only email you to log you in, to invite you, or to confirm an email change. No newsletter, no product announcements. Messages leave through Postmark from login@sinterlab.dev, an address nobody reads.
Cookies and local storage
One session cookie keeps you logged in; a second, optional cookie remembers you for 14 days when you ask for it. Your theme preference lives in your browser's local storage. There are no analytics or advertising cookies.
Retention
- Login links expire after 15 minutes, sessions after 14 days; expired ones are deleted daily.
- Invitations expire after 7 days and are deleted a week later if never used. Accepted and revoked invitations are kept as part of the organization's history.
- Account, organization and audit records are kept while the account exists.
- Which tests passed and failed on a commit is kept for 14 days after its last upload. The flaky tests found from it stay. Everything else uploaded for a repository is kept until an owner deletes it, which removes it at once. Runs from before a deletion are never taken again. When a repository leaves the GitHub connection (removed from the App, or GitHub disconnected), its uploaded data is deleted 30 days later.
Where it lives
The application and its database run on Fly.io in São Paulo. Email is delivered by Postmark. Nothing is shared with anyone else.
Deleting your data
Write to volcov@sinterlab.dev from the address in question. With an account, we delete it, its memberships and its invitations, and strip your address, IP address and user agent from the audit trail. If you are the only owner of an organization, we ask what to do with it first. Without an account (a waitlist signup, an invitation you never used), we delete the signup and the invitations and strip the address from the audit trail the same way.