Privacy Policy

1.At a glance

This policy covers Ambih Monitor and Ambih Code Helper, and the website you are reading it on. Both are built to be honest about what they process and why. The short version:

• We collect what we need to deliver the Service, and nothing else. For Ambih Monitor that includes an overview of performance signals from the projects you monitor, so the Service can compute history, baselines, anomaly verdicts and the other analytics features.
• Ambih Code Helper never sends us your source code. It reads and indexes your repositories entirely on your own machine; the index, and everything derived from it, stays on your disk. We receive no code, no file names, no symbol names and no repository paths. See section 4.
• An Account is only required for the Pro Subscription; the Free Tier does not require one.
• We never sell your personal data. We do not use it for advertising and we do not share it with advertising networks.
• Payments go through a third-party payment provider. We never see your card number.
• The Site uses only first-party server-side analytics. No Google Analytics, no Meta pixel, no third-party advertising trackers.
• You have rights. You can request access, correction, deletion or export of your data at any time by writing to [email protected].

2.Who is responsible for your data

For the purposes of applicable data-protection law (such as the GDPR, where it applies to you), the "data controller" of your personal data is the independent operator of Ambih Monitor, Ambih Code Helper and this Site (the "Operator"). You can reach us at [email protected] for any privacy matter, and at [email protected] for general legal correspondence.

We do not currently have a designated "Data Protection Officer". If the law applicable to you requires you to deal with a local representative as a precondition for using the Service, please contact us first; depending on volume we may not yet meet the thresholds that require us to appoint one.

3.Personal data we collect

We collect personal data in a small number of specific situations. We have summarised them in the table below; the sections that follow explain each one in more detail.

What we do not collect

• we do not collect your source code, in either product — not its contents, not its file or folder names, not the names of the symbols inside it, and not the paths of the repositories or projects you open;
• we do not collect the contents of your stdout/stderr log lines or your environment variables;
• we do not collect your user name, computer name, IP address or MAC address from the Desktop Apps. The device fingerprint described above is a one-way hash computed on your machine, and the device label shown in your account is deliberately built from the platform, architecture and core count only;
• we do not collect biometric data, precise geolocation data, or any "special category" data as defined by the GDPR;
• we do not use any third-party advertising or behavioural-profiling tracker, on the Site or in either Desktop App;
• we do not sell, rent or otherwise make your personal data available to data brokers.

4.How the Desktop Apps handle your data

The two applications are very different in what they send us, so they are described separately. Everything below the two headings — authentication, crash reports — applies to both.

Ambih Monitor

When you launch a project through Ambih Monitor, it samples resource usage from the operating system, computes derived statistics (averages, percentiles, peaks) and applies its analytical algorithms. These include scaled median absolute deviation for spike detection, one-sided CUSUM for memory-drift detection, and weighted multi-factor robust z-score for cross-session regression detection. It then surfaces the resulting verdicts and history back to you.

As described in section 3, Ambih Monitor reports to us an overview of performance signals from the projects you monitor (resource statistics, derived analytical signals, session metadata and the application version) together with the session and licensing signals needed to confirm that your subscription is valid. We use this information to deliver the analytics, history and cross-session features of the Service, to surface verdicts back to you, to debug the Service, and to improve it over time.

We do not collect the contents of your stdout/stderr log lines, your source code or your environment variables. Ambih Monitor processes those streams only to surface them back to you inside the application.

Ambih Code Helper

The index itself, together with your registered project list, your settings, any repository you clone through the app and any temporary git worktree it creates, is written to your own machine under your local application-data folder. You can delete it at any time; removing a project from the app deletes that project's index with it.

The application does contact us, but only for things that are not about your code: to sign you in, to confirm your subscription is still valid, to fetch current pricing for the licence page, to check whether a newer version is available, and to deliver feedback you choose to send. Those requests are listed in section 3 and carry no information about the repositories you have open.

Ambih Code Helper also writes diagnostic log files on your machine. They record licensing and start-up events, and if the application ever closes unexpectedly it records that too, so a problem can be diagnosed. Those files stay on your disk and are kept for seven days; they are only ever sent to us if you choose to attach one to a support message. Values that look like credentials are masked before anything is written.

Authentication and licensing

This works the same way in both applications. When you sign in to link an application to your Account, the Service exchanges a one-time OAuth authorisation code for an access token and a refresh token bound to that device. While it is signed in, the application periodically reports session and licensing signals (timestamp, Account identifier, device fingerprint, application version) so that the Service can confirm your Pro Subscription remains active. If those checks fail, the application reverts to Free Tier features. The tokens are stored encrypted on your own machine, protected so that only your user account on that device can read them.

The device fingerprint is a one-way hash, computed on your machine from stable characteristics of that machine and your user account on it. Only the hash reaches us: we cannot recover the values it was built from, and it identifies the installation rather than you.

Crash reports and diagnostics

If an application crashes, we do not collect a crash report automatically — nothing is transmitted. The details are written to a file on your own machine so that you can read them or send them to us. If you decide to send one to help us reproduce a bug, the file you send will be treated as a support message: whatever you have chosen to include in it will be processed solely to answer your request, and retained in line with the retention windows in section 8.

5.Why we process your data (and our legal bases)

Where the GDPR applies to you, we rely on the following legal bases:

• Performance of a contract: to provide the Service to you. This covers Account creation, payment, subscription management, the OAuth flow, the heartbeat, and any support we provide.
• Compliance with a legal obligation: to keep tax and accounting records relating to your payments, and to respond to lawful requests from public authorities.
• Our legitimate interests: to keep the Service secure (preventing fraud, abuse and unauthorised access), to produce aggregate server-side traffic statistics, and to improve the Service. Where we rely on legitimate interests we balance them against your rights and freedoms, and you have the right to object (see section 9).
• Your consent: for any optional feature we may introduce in the future that processes personal data beyond what is strictly necessary to deliver the Service. You can withdraw consent at any time.

6.Who we share your data with

We do not sell or rent your personal data to anyone. We share it only with the following categories of recipient, and only to the minimum extent necessary:

Sub-processors

We require every Sub-processor to handle personal data only on our written instructions, to apply appropriate security measures, and to comply with applicable data-protection law. We update this list when it changes.

Public authorities

We may disclose your personal data if we are required to do so by law, by a competent authority, or in response to a valid legal process. We will, where legally permitted, notify you before doing so.

Business transfers

If the operator of Ambih is ever reorganised, merged, sold or acquired in whole or in part, your personal data may be transferred to the successor entity as part of that transaction. Any successor will be bound by terms at least as protective as this Privacy Policy.

7.International data transfers

The Operator, our Sub-processors and our infrastructure may be located in jurisdictions other than your own. When we transfer personal data outside the country or region in which you are located, we rely on appropriate safeguards (such as recognised standard contractual clauses or an equivalent transfer mechanism) supplemented where necessary by additional technical and organisational measures.

You can request a copy of the safeguards in place for a specific Sub-processor by writing to [email protected].

8.How long we keep your data

We keep personal data only for as long as we have a clear reason to keep it. The main retention windows are:

We may retain data for longer where required to comply with a legal obligation, to defend a legal claim, or to investigate a security incident.

9.Your rights

Depending on your country of residence, you have some or all of the following rights over your personal data:

• Right of access: obtain confirmation that we process your personal data, and request a copy of it;
• Right to rectification: ask us to correct inaccurate or incomplete data;
• Right to erasure ("right to be forgotten"): ask us to delete data we no longer have a lawful basis to keep;
• Right to restriction: ask us to limit processing in specific circumstances (for example, while we investigate a complaint);
• Right to data portability: receive a copy of data you provided to us in a structured, commonly-used, machine-readable format;
• Right to object: object to processing carried out on the basis of our legitimate interests;
• Right to withdraw consent: where we rely on your consent, you can withdraw it at any time without affecting the lawfulness of past processing;
• Right to lodge a complaint: complain to the data-protection authority in your country of residence if you believe we have mishandled your data. We would prefer that you reach out to us first so we can try to put things right.

To exercise any of these rights, write to [email protected] from the email address associated with your Account. We will respond within 30 days; in complex cases we may extend that period by a further two months and we will tell you why. We may need to verify your identity before acting on a request; we will keep that verification proportionate to the sensitivity of the data involved.

10.Cookies and similar technologies

The Site uses only the cookies it needs to function properly. We do not set any cookie for advertising or for third-party behavioural tracking.

When you log in to your Account, additional cookies are set to keep you authenticated. You can clear all cookies at any time through your browser settings; doing so will sign you out and reset your preferences.

11.Security

We apply appropriate technical and organisational measures to protect your personal data, including:

• TLS (HTTPS) for all traffic between your browser or Desktop App and our servers;
• passwords stored as one-way salted hashes, never in plain text;
• card numbers handled exclusively by our payment provider in tokenised form;
• access to production systems restricted to the minimum number of trusted individuals, with strong authentication;
• short-lived access tokens combined with device-bound refresh tokens for the Desktop App OAuth flow;
• regular review of dependencies and prompt application of security patches.

No system is perfectly secure. If we ever become aware of a personal-data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority and, where required, you, in accordance with applicable law.

12.Children's privacy

The Service is not directed at children under the age set out in section 4 of the Terms of Service. We do not knowingly collect personal data from children under that age. If you believe that a child has provided us with personal data, please contact [email protected] and we will delete it.

13.Automated decision-making

We do not make decisions that produce legal effects on you, or similarly significantly affect you, on the basis of automated processing alone. The Desktop App's analytical features (anomaly detection, regression verdicts, baseline computation) are decision support for you; they do not make decisions about you.

14.Changes to this Privacy Policy

We may update this Privacy Policy from time to time. When we make a material change we will:

• update the "Last updated" date at the top of the page;
• where reasonably practicable, notify Account holders by email at least fourteen (14) days before the change takes effect;
• never enable a new processing activity that requires your consent without first asking you.

Older versions of this Privacy Policy are available on request.