LanesPrivacy policy
This policy explains what personal data Lanes handles, why, and what rights you have. It applies to the Lanes website, the Lanes VS Code extension and any hosted Lanes service we operate. It is written to meet the EU General Data Protection Regulation (GDPR).
1. Who is responsible
The data controller is Michele Matozza, an individual founder trading as Lanes (no company has been formed yet) ("Lanes", "we"). Contact: privacy@trylanes.app.
2. Short version
- We do not receive your source code or your prompts.
- The self-hosted Community edition sends nothing to us. The coordination server runs on your own machine or network.
- The website sets no cookies and uses no analytics or advertising trackers.
- The extension keeps a small local file on your own machine (
~/.lanes/ledger.jsonl) that counts how coordination went: the time, a short hash of the repository, whether an edit was coordinated, queued or went ahead because the server was unreachable, and a number of milliseconds. It holds no file paths, file contents, prompts or names.lanes reportshows it to you. Nothing leaves your machine unless you choose to send it to us yourself, for example by pasting a report into an email.
3. What we process
| Where | Data | Why | Legal basis (GDPR art. 6) | Retention |
|---|---|---|---|---|
| Website | IP address, user agent and requested page, in the hosting provider's server logs | Deliver the site, keep it secure | Legitimate interests (f) | As kept by the host, typically up to 30 days |
| Beta request (the form on the website) | Your email address, your team size, and the time and wording version of your consent | Send you the private-beta access instructions and run the beta. We also read each request ourselves | Consent (a), and steps at your request before a contract (b) | Until the beta ends or you ask us to delete it, at most 12 months |
| Contact email | Your email address and what you write | Reply to you, run the private beta | Steps at your request before a contract (b) or legitimate interests (f) | Until the request is closed, then up to 12 months |
| Extension and self-hosted server | Repository identifier, repo-relative file paths, display name, session IDs and statuses are processed on your own server | Show your team's agents and coordinate edits | Not processed by us | In memory on your server; gone when it stops |
| Your own machine: the local ledger | Time, a short hash of the repository, edit kind (coordinated, queued, uncoordinated) and a duration in milliseconds. No file paths, contents, prompts or names. A count of uncoordinated edits (a number only) also goes to your own coordination server so your team can see it | Show you how coordination went for you; not processed by us | Not processed by us unless you send a report | On your machine only; the file is capped at about 512 KB and you can delete it at any time |
| A report or feedback you email us | What you chose to paste or write: the report (counts and times) and any notes | Understand how the product is used and what to build next | Consent (a) by sending it, or legitimate interests (f) | Until we have used it for that purpose, then up to 12 months |
| Hosted service (paid plans, not yet launched) | The same metadata, plus account details (name, work email, billing details) | Provide the service, billing, support | Contract (b), legal obligation (c) | While your account is active, then as the law requires; to be confirmed at launch |
We never receive file contents, prompts or agent conversations. Source code moves only between your machines and your own git remote.
4. Cookies and similar technologies
The website uses no cookies and no local storage that identifies you. The request form sends your data only to our own address on this site; the page itself loads nothing from other companies. See the cookie policy.
5. Who we share data with
We use service providers (processors) only where needed: website hosting and the form endpoint, Vercel; storing beta requests and sending email, Resend; and, for the hosted service once launched, infrastructure and payment providers. They process data on our instructions under data processing agreements. We do not sell personal data.
6. Transfers outside the EU/EEA
Resend and Vercel are based in the US. If a provider processes data outside the EU/EEA, we rely on an adequacy decision or the European Commission's Standard Contractual Clauses.
7. Your rights
You can ask us to access, correct, delete or export your personal data, to restrict or object to its processing, and to withdraw consent where we rely on it. Write to privacy@trylanes.app. We answer within one month. To be deleted from the beta list, write to us or reply "delete" to the instructions email; we remove your contact record and our copy of the request. You can also complain to your data protection authority. In Italy this is the Garante per la protezione dei dati personali (garanteprivacy.it).
8. Security
The Lanes server requires a token on every request, local state is kept in a folder private to your user account, and secrets in your files are never published by the hook. No system is perfectly secure; we will notify you and the authorities of a breach as the law requires.
9. Children
Lanes is a professional tool and is not directed at children under 16.
10. Changes
If we change what data the extension or the service sends to us, we will update this policy before the release that changes it, and say so in the release notes.