Privacy

Lambda Brief is operated by Hello World s.r.o., Šoltésovej 720/16, 965 01 Žiar nad Hronom, Slovakia. Company ID (IČO) 52584429, Tax ID (DIČ) 2121073779. We are the data controller for the personal data described here.

For anything in this policy, write to [email protected].

Only what the service needs to work. There is no hidden collection beyond this list.

• Your account. Your name, email address, GitHub username and avatar, taken from GitHub when you sign in.
• Your repositories. The names of the repositories you connect, whether each one is private, and the package and tool names we read from your manifests.
• Your digest settings. The digests you set up, the packages and projects you follow, your schedule, timezone and filters, and a record of what we've already sent you so we don't send it twice.
• Your newsletter subscription. If you sign up for the free newsletter: your email address, when you signed up, confirmed and unsubscribed, which editions we sent you, and whether our email provider reported the address as undeliverable. You don't need an account for it.
• Link clicks. Links in the digests and newsletters we send, and on digest timeline pages, pass through a short redirect on our own domain that counts the click before sending you on. We record which release, article, advisory or event link was opened, and which digest edition or newsletter email it came from — so a click is tied to you as that digest's owner or that email's reader. Not your IP address or anything about your browser. Links on the newsletter's public archive pages go straight to their source and aren't counted.
• Account activity. A log of what you do in your account — signing in, connecting GitHub or Slack, creating or changing a digest, billing changes — with the time it happened, so we can help when something goes wrong. Not page views, and nothing about your browser.
• AI usage. For each digest edition we write for you, a record of the AI requests behind it — when each ran, which model, how long it took, how many tokens it used and what it cost — so we know what the service costs to run. Not the text sent to the model or what it wrote back.
• Your connections. Access tokens for GitHub and Slack, stored encrypted, plus your Slack workspace and the channel you chose.
• Your billing state. Your plan, trial dates, and customer and subscription identifiers from Polar.
• Technical logs. Errors and performance, both on our servers and in your browser, which can include your IP address, your browser and the page you were on. We use Better Stack for this, and its script runs on every page.

• Not your source code. Our GitHub app reads your package manifests — the files that list your dependencies, like package.json, pyproject.toml or Gemfile. We parse them, keep the package and tool names, and throw the files away. Nothing else in your repositories is ever stored. A manifest you upload by hand is handled the same way: parsed on arrival, never kept.
• Not your Slack messages. Our Slack app can list your channels and post to the one you pick. It does not hold the permission needed to read messages, so it cannot read them — even if we wanted to.
• Not your card details. Payment happens on Polar's checkout page. Card numbers never touch our servers.
• No advertising, no marketing analytics. There are no ad networks, no tracking pixels, no cross-site tracking, and nothing that follows you around the web. The link-click counting described above happens on our own domain and stays there. We do not sell or share your data. We do run one third-party script — Better Stack, which tells us when a page breaks or runs slowly — and it's described above.

Read-only access to sign you in, list your repositories, and fetch your package manifests — it has no write access, so it cannot change anything. Why the permission it asks for looks broader than that, and exactly what we read, is explained on our security page.

OpenAI models, reached through OpenRouter, summarize the public release notes and articles in a digest or newsletter edition and write its introduction and stories. We send the public source text or its summary, the names of the public projects and packages covered — vercel/next.js, say — and update metadata such as release types and security severity.

Nothing identifying you goes with it: no name, no email address, no account id. And we never send your source code, your manifests or the names of your own repositories to an AI model. Nothing of yours is involved in producing the summaries or editorial copy.

We use a small number of processors to run the service. We host the app and the database in the EU, but some of these companies are based outside it and may process data there. Where they do, the transfer rests on the European Commission's standard contractual clauses.

Your integrations work differently. The services you connect already hold your data: your code is on GitHub, your team already talks in Slack. Connecting them doesn't move anything anywhere new. It lets us read what you allow us to read, and post where you tell us to post, under permissions you grant and can withdraw at any time. What those companies do with the data they already hold is governed by their terms, not ours.

Almost everything here we hold to perform our contract with you — we cannot send you a digest without knowing what you depend on and where to send it. The newsletter we send on your consent, which you give by confirming your address and withdraw with the unsubscribe link in every email. We keep server logs and error reports on the basis of our legitimate interest in keeping the service secure and working. Billing records we keep because Slovak law requires it.

Most of what's in our database isn't about you at all: it's a library of public releases, changelogs and articles gathered from the open web, and we keep that indefinitely. The part that concerns you — your account, your repositories, your digests and your settings — we keep for as long as your account exists.

Ask us to delete your account and we'll delete it, along with your connected repositories, digests and settings, within 30 days. Billing records we have to keep for as long as Slovak tax law requires.

A newsletter subscription stays on record after you unsubscribe, so we never email that address again by mistake. Ask us and we'll delete it, along with the record of what we sent you and what you clicked.

Under the GDPR you can ask us for a copy of your data, correct it, have it deleted, or object to how we use it. Email [email protected] and we'll take care of it — there's no form to fill in.

If you think we've handled your data badly, you can complain to the Slovak data protection authority (Úrad na ochranu osobných údajov Slovenskej republiky). We'd rather you told us first, so we can put it right.

We set one cookie ourselves, when you sign in, so we know it's you on your next request. It isn't used to track you, and we don't use cookies for advertising or marketing analytics.

We host in the EU, encrypt traffic in transit and your access tokens at rest, and limit production access to the people who need it. The details — including how to revoke our access at any time — are on our security page.

No service is perfectly secure. If we ever discover a breach that puts your data at risk, we'll tell you and the regulator, as the law requires.

If we change this policy we'll update the date at the top, and we'll email you before anything that materially affects you takes effect.