Legal
Privacy
What this site knows about you, what Conductor Cloud stores, and what neither of them can see.
This site sets no cookies.
No analytics vendor, no tag manager, no embedded video, no font CDN — the typefaces are served from this origin. There is no consent banner because there is nothing to consent to, and that is the version of this we would want to read.
What we can see
Our reverse proxy writes an access log: the path requested, the status code, the referring page, and a truncated user agent. It is aggregated for counts — which pages get read — and it is not joined to anything that identifies a person.
Links from this site to the console carry a ?ref= parameter naming the page you left from. That is the whole of our attribution. The cost is stated honestly: we have no per-visitor funnel and cannot tell you how many people read the pricing page before signing up. We accept that in exchange for the paragraph above.
Conductor Cloud
If you use the hosted control plane, it stores what a release platform needs to do its job: your organisation, the people in it, your projects, your runs and their logs, and your credentials — encrypted at rest with a key we hold separately from the database.
- Credentials
- Encrypted at rest. No API returns credential material, to anybody, including you and including us — there is no route that can. What we can see is that a credential exists, what purpose it serves and when it was last used.
- Your source code
- Never stored. Conductor reads release.yaml from your repository at a commit and hands a clone token to your own runner. The code is checked out on your machine and stays there.
- Build artifacts
- Stored in your object store on a self-hosted deployment. On Cloud, in ours, for the retention period of your tier.
- The audit log
- Append-only and hash-chained per organisation. It records who did what and when. It is never truncated, including when run and log retention expires — a chain with a hole in it is not a chain.
- Self-hosted deployments
- We see nothing. There is no phone-home, no licence check and no telemetry. We do not know your deployment exists unless you tell us.
Connect Google
Conductor can create the service accounts it publishes to Google Play and distributes through Firebase with, so nobody has to make and upload their keys. That needs one consent from a person who administers the Play developer account and owns the Google Cloud project: the Connect Google button in the console. This section is about what that consent gives us.
The consent asks for four permissions: your email address and basic sign-in (openid, email), full access to Google Cloud (cloud-platform), and the Google Play Developer API (androidpublisher). The Cloud permission is broad: we ask for it rather than a separate, narrower permission for each Google Cloud service we call, so that one consent covers all of them. That means the limit on what we do with it is our behaviour, not Google’s scoping, so we state that behaviour below.
- What we keep
- One refresh token per organisation, encrypted at rest like every other credential, and the email address of the person who granted it, so the audit log can say who connected Google. We do not read or store anything else from your Google account — not your mail, contacts, Drive or profile.
- What we use it for
- Creating two service accounts in your Google Cloud project and a key for each; enabling the Google APIs they need; giving the Firebase one the App Distribution role; adding the Play one to your Play developer account with release and tester permissions and nothing financial; and registering your apps in Firebase. Nothing else, and only when you have asked Conductor to provision a project.
- Who can see it
- Nobody. No API returns it, to anybody, including you and including us. It is never given to a build or a runner, never attached to a project and never copied into a repository’s secrets. The control plane’s provisioning service is the only thing that reads it.
- Who we share it with
- Nobody. We do not sell, transfer or disclose Google user data, and we do not use it for advertising or to train models. Conductor’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
- Taking it back
- Revoke Conductor at myaccount.google.com/permissions, and Google stops honouring the token everywhere. Conductor then asks you to connect again. Connecting again retires the earlier grant, and deleting the organisation deletes it. The service accounts and keys Conductor created stay in your Google Cloud project until you delete them there.
- Self-hosted deployments
- You register your own OAuth client in your own Google Cloud project, and the token lives in your own database. We see nothing.
Your rights, and the practical version
You can ask us what we hold about you, ask for it to be corrected, and ask for it to be deleted — write to privacy@mangozestlabs.com and we will answer within thirty days.
Deleting an organisation deletes its projects, runs, logs, artifacts and credentials. The audit log is the exception and the reason is the one above: an append-only chain that supports selective deletion is not append-only. If that is a problem for your jurisdiction, self-host — then it is your log, in your database, under your policy.