Privacy Policy

Last updated: July 25, 2026

This Privacy Policy explains how Teamfox LTD ("Teamfox", "we", "us", or "our") handles personal data when you use the LPM.dev Registry at lpm.dev and related Teamfox-hosted services.

Teamfox LTD is registered in England and Wales under company number 09961114 and is the controller responsible for the processing described in this policy. Its registered office is:

Teamfox LTD, 8 Haynt Walk, London SW20 9NX, United Kingdom

Privacy questions and rights requests can be sent to privacy@lpm.dev.

1. Data We Collect

Account and Profile Data

When you create or manage an account, we collect:

Email address and password hash
Username, display name, avatar, and profile fields you choose to provide
Authentication identities, multi-factor authentication state, recovery and security events
Account plan, preferences, and deletion state

Supabase Auth processes authentication credentials. Teamfox does not store plaintext account passwords.

Organization and Collaboration Data

For organizations and integrations, we collect:

Organization name, slug, description, website, location, and logo
Memberships, invitations, roles, and IP allowlist settings
GitHub connection, installation, repository, invitation, and identity metadata when you connect GitHub
OIDC claims and policy configuration when you enable GitHub Actions or GitLab CI access

Billing, Marketplace, and Payout Data

When you subscribe, purchase, sell, or receive a payout, we collect:

Billing name, email, address, and tax-calculation information
Card brand, last four digits, and expiry where Stripe makes those details available for display
Stripe customer, payment, invoice, subscription, refund, dispute, tax, Connect, and payout identifiers
Marketplace purchase, entitlement, seat, pricing-plan, fee, and settlement records
Pool contribution, usage-allocation, revenue-share, adjustment, and payout records

Stripe processes full payment-card numbers and security codes. They do not pass through Teamfox servers.

Package and Registry Data

When you publish, install, or manage packages, we collect:

Package metadata, manifests, documentation, versions, dependencies, and uploaded archives
Public-distribution requests, scan results, review findings, administrator decisions, and publication events
Download and install records, including package, version, depth, token or account association, IP address, user agent, and timestamp where applicable
Package settings, pricing, distribution, entitlement, analytics, and lifecycle records

Public package content and metadata are public. Private package content is restricted to authorized users and operational systems.

Encrypted Environments and Remote Cache

For encrypted environment sync, we store encrypted secret ciphertext, encrypted key material, access-control records, version information, and operational metadata. Encryption and decryption occur in authorized clients; Teamfox does not receive the plaintext secret values through the normal sync flow.

Remote cache stores uploaded build artifacts and related namespace, size, integrity, retention, and access metadata.

Tunnels and Webhook Tools

Tunnel services relay request and response traffic between a public endpoint and your connected local service. We process that traffic in transit and collect the connection, domain, owner, timing, protocol, request, error, and usage metadata needed to operate, secure, troubleshoot, and bill the service.

Webhook inspection and replay can store request or response content that you choose to capture. Do not expose or capture data you are not authorized to process.

AI Features

We process:

Public package content submitted for mandatory Pool or Marketplace review
Public package metadata used for summaries, search, embeddings, and related Registry features
Chat messages and the context selected to answer them
Model, token, timing, status, error, review, and audit records

Teamfox does not submit private package contents for automatic background AI processing. If an authorized owner or organization member explicitly asks AI chat about a private package, the requested message and relevant private metadata or README excerpt are sent to the configured provider for that response. The chat interface discloses this before use.

Do not place environment secrets, registry tokens, credentials, or unrelated personal data in AI prompts.

Security and Audit Data

We collect:

IP address, user agent, country result, session ID, timestamps, and authentication events
Registry tokens, refresh sessions, token scopes, expiry, revocation, and usage metadata
Audit records for significant account, organization, package, billing, security, and administrative actions
Rate-limit, fraud, abuse, anomaly, malware, and incident information

Support and Communications

We collect messages, attachments, account references, and other information you send to support, privacy, security, copyright, or business contacts.

2. Analytics and Tracking

Anonymous Cookieless Telemetry

The LPM.dev Registry uses PostHog for anonymous per-session telemetry even when you have not granted persistent analytics consent or have selected Decline.

In this mode:

PostHog uses memory-only persistence
It does not use PostHog cookies or localStorage to recognize you across browser sessions
We collect anonymous page-navigation, page-leave, browser-error, and exception events
Session recording is disabled
Signed-in identity is not attached to the anonymous session

We use this limited telemetry for service reliability, error diagnosis, security, and aggregate product improvement based on our legitimate interests.

Persistent Analytics

If you select Accept, PostHog may additionally:

Store identifiers in cookies and localStorage
Recognize activity across sessions
Associate activity with your account after sign-in
Record sessions with form inputs masked

We rely on consent for persistent analytics identity, analytics cookies, and session recording. You can withdraw that consent by clearing the stored analytics choice and selecting Decline when the banner appears again.

Selecting Decline stores the choice in localStorage so the banner remains dismissed. It prevents persistent PostHog identity and session recording, but anonymous cookieless per-session telemetry continues.

Package-Owner Analytics

Package owners can configure Google Analytics, Plausible, Fathom, or Umami for their public package pages. These provider scripts are selected by the package owner and may receive the page URL, IP address, device information, or other data under that provider's terms.

These scripts are separate from Teamfox's PostHog analytics choice and can currently load independently of your LPM.dev Registry analytics preference. The package page identifies the package owner responsible for the configuration.

3. Why We Use Data

We process personal data to:

Provide accounts, package hosting, Registry access, organizations, environments, tunnels, remote cache, purchases, subscriptions, and entitlements
Process payments, calculate tax, administer seller accounts, distribute Pool revenue, and reconcile refunds or disputes
Secure the software supply chain, review public packages, detect abuse, and respond to incidents
Provide support and send transactional, security, billing, invitation, payout, and policy notices
Operate anonymous telemetry, diagnose errors, and improve the Services
Meet accounting, tax, legal, regulatory, and law-enforcement obligations
Establish, exercise, or defend legal claims

UK and EEA Lawful Bases

Basis	Processing
Contract	Accounts, private packages, organizations, purchases, subscriptions, entitlements, environments, tunnels, support, and seller payouts
Consent	Persistent analytics identity, analytics cookies, session recording, and optional communications where consent is required
Legitimate interests	Anonymous cookieless telemetry, service improvement, fraud prevention, security monitoring, auditability, public Registry integrity, and legal claims
Legal obligation	Tax and accounting records, sanctions and payment compliance, lawful requests, and regulatory duties

Where we rely on legitimate interests, you can object as described under Your Rights.

4. Who Receives Data

We do not sell personal data. We disclose it where needed to operate the Services, follow your instructions, comply with law, or protect rights and safety.

Service Providers

Provider	Purpose	Typical data
Supabase	Authentication and managed Postgres database hosting	Accounts, password hashes, sessions, application and audit data
Cloudflare	DNS, CDN, security, Workers, KV, R2 object storage, Durable Objects, Registry delivery, and tunnels	Network data, package archives, media, Registry and tunnel traffic, operational metadata
Hetzner	Application and worker hosting infrastructure	Application data and server or operational logs processed by hosted services
Stripe	Billing, payments, subscriptions, Connect, payouts, disputes, and automatic tax calculation	Identity, contact, billing, payment, purchase, tax, and payout data
PostHog	Anonymous and consent-based product analytics	Page events, errors, device data, optional account identity, and optional masked session recordings
Resend	Transactional email delivery	Recipient, message content, and delivery metadata
ipapi.co	Country lookup during signup for regional availability checks	Signup IP address and returned country code
OpenAI and OpenRouter	AI chat, public-package review, analysis, and embeddings	Prompts, selected context, public package content, output, and operational metadata
GitHub and GitLab	User-requested integrations and OIDC verification	Account, repository, installation, workflow, and signed identity claims

Stripe automatic tax calculates and collects tax information for configured transactions. Teamfox and sellers remain responsible for tax registrations, reporting, and filing allocated to them by applicable law; this policy does not state that Stripe performs those filings.

Package Sellers and Owners

A Marketplace seller receives information needed to identify and administer a purchase, subscription, license scope, support relationship, refund, or dispute. Package owners with analytics enabled receive data through their configured analytics provider.

AI Processing

OpenAI and OpenRouter may route or process a request according to the configured model and their applicable terms. Temporary extracted package-analysis copies are discarded after processing. Teamfox retains review verdicts, findings, coverage, errors, administrator decisions, and audit records needed for Registry security and accountability.

Legal and Corporate Disclosures

We may disclose data:

With your consent or at your direction
To comply with law, court orders, or valid government requests
To investigate fraud, security incidents, abuse, or infringement
To protect Teamfox, users, sellers, third parties, or the public
In connection with a financing, merger, acquisition, reorganization, or sale, subject to appropriate confidentiality and notice

5. Cookies and Local Storage

Essential browser storage supports authentication, security, checkout, and saved preferences. It does not require analytics consent where it is strictly necessary to provide a requested service.

PostHog persistent analytics cookies and cross-session localStorage are enabled only after Accept. Anonymous PostHog telemetry uses memory-only persistence.

The analytics-choice value itself is stored in localStorage as cookie_consent. Clearing it resets the choice.

Package-owner analytics can use separate cookies or storage according to the selected provider's implementation. See Package-Owner Analytics above.

6. Retention

Data	Current retention
Active account and organization data	While active and as needed to provide the Services
Deleted account or organization row	Restoration is available for 30 days; permanent deletion is scheduled after 180 days
Soft-deleted private packages	30 days before permanent package and archive deletion
Pool and Marketplace packages	Retained for public Registry history, security, and existing entitled users
User and organization audit logs	90 days
Administrative audit logs	365 days
Inactive application session records	90 days after last activity
Webhook deliveries	30 days
Locally stored Stripe webhook events	90 days
Package download IP addresses	Removed from download records after 90 days
Remaining package download records	Retained for Registry analytics, anti-fraud controls, and Pool accounting without the historical IP address
AI processing logs	7 days
Publication-review verdicts and decisions	Retained for Registry security, incident investigation, and auditability
PostHog events and recordings	According to Teamfox's configured PostHog retention settings

When you request account deletion:

The account becomes unavailable and can be restored for 30 days through support.
Active sessions and registry tokens are revoked as part of the deletion process.
Subscriptions are scheduled for cancellation.
Private packages are scheduled for deletion.
Avatar and membership cleanup begins.
The core user or organization row is retained in deleted state for up to 180 days before permanent deletion.
Payment, fraud, security, legal, public-package, and anonymized records can survive where necessary for their stated purpose.

Usernames associated with Pool or Marketplace packages remain reserved to protect package identity and prevent impersonation.

Signing out ends the selected browser session. It does not automatically revoke independent LPM CLI sessions or every other signed-in device; use Sign out everywhere or revoke the relevant Registry credentials when needed.

7. Your Rights

Depending on your location and applicable law, you may have rights to:

Access personal data we hold about you
Correct inaccurate or incomplete data
Request deletion
Restrict or object to processing
Receive portable data
Withdraw consent without affecting earlier lawful processing
Complain to a data-protection authority

Account profile, analytics choices, sessions, registry tokens, data export, and deletion controls are available through the dashboard where supported.

To exercise a right, email privacy@lpm.dev. We may need to verify your identity. We aim to respond within one month, subject to extensions and exceptions permitted by law.

UK users can complain to the Information Commissioner's Office. EEA and other users may also contact the competent authority where they live or work.

8. International Transfers

Teamfox is established in the United Kingdom. Providers and users may process data in the United Kingdom, European Economic Area, United States, and other countries.

Where transfer restrictions apply, we use an applicable adequacy regulation or appropriate contractual safeguards, such as the United Kingdom International Data Transfer Agreement or Addendum and European Commission Standard Contractual Clauses, as appropriate to the provider and transfer.

Contact privacy@lpm.dev for information about the safeguard relevant to a particular transfer.

9. Security

We use technical and organizational measures including:

TLS for data in transit
Managed encryption at rest
Row-Level Security and server-side authorization controls
Password and registry-token hashing
Client-side encryption for environment secret values
Multi-factor authentication and step-up verification for sensitive actions
Rate limiting, anomaly detection, package review, and malware controls
Content Security Policy and webhook-signature verification
Audit trails and credential-revocation controls

No system is completely secure. We will notify affected users and authorities of a personal-data breach where required by law.

Privacy: privacy@lpm.dev
General support: hello@lpm.dev
Address: Teamfox LTD, 8 Haynt Walk, London SW20 9NX, United Kingdom