Privacy Policy

1. Who is responsible

Happy Coder Industries Limited is responsible for Dogger’s handling of personal data as controller where applicable. We are an English private limited company, number 14121168, with registered office at Unit 2 Beverley Court, 26 Elmtree Road, Teddington, England, TW11 8ST.

For privacy questions or rights requests, email [email protected].

2. Data kept locally

Dogger is primarily local software. It keeps the following data on your Mac rather than in a Dogger cloud account:

• settings and window state in ~/.dogger/config.json;
• project, context, task, script, resource, run-history, and AI conversation data below ~/.dogger;
• installation-wide helper files below ~/.dogger/library, separate from each context’s helper files;
• Shared Project repository checkouts, staged and approved revisions, review and conflict state, imported task baselines, and local project/context mappings below ~/.dogger;
• telemetry consent and a random installation identifier in local configuration, plus separate bounded telemetry and feedback delivery queues below ~/.dogger/offline/queues;
• provider-neutral AI token-usage records, without prompts or responses, below ~/.dogger/usage;
• the Premium licence key in macOS Keychain, with non-secret plan, purchaser-display, and validation metadata plus a random licence-install identifier in local configuration; and
• the website-view zoom percentage in the macOS webview’s local storage.

API credentials for OpenAI, Anthropic, xAI, and OpenRouter are stored in separate macOS Keychain entries. Local configuration records only whether models are enabled and which model each AI feature should use. Dogger’s desktop interface receives credential-presence status, not saved credential values. Protect access to your macOS account and Keychain.

Dogger does not automatically upload local projects, tasks, histories, or settings to us. Tasks you choose to run are programs and may access data or networks independently of Dogger’s product-controlled flows.

3. Purchases and licence validation

Happy Coder Industries Limited sells Dogger Premium. The purchase form sends the name, email address, and selected Lifetime or Yearly product, plus any discount code you choose to apply, to Dogger. Dogger stores the order details, applicable GBP price and licence-length snapshot, discount terms, and temporary or completed discount-use record. For a paid order, Stripe processes payment through its hosted Checkout under Stripe’s own terms and privacy practices. Stripe is a payment processor, not the merchant of record for Dogger. If Dogger provides a discounted licence without taking payment, no checkout or buyer data is sent to Stripe.

A signed Stripe webhook confirms paid fulfilment; Dogger’s server authorizes free discounted fulfilment. Dogger stores the purchaser name, normalized email, product and terms, pricing and discount snapshots, timestamps, status, and nullable Stripe order/payment references. It stores only a keyed hash and short support prefix for the licence key, not the full key. Resend receives the recipient address and licence email content so it can deliver the key.

When you enter or retain a Premium key, Dogger sends that key and a random licence-install identifier to doggerapp.com. The identifier is generated on your Mac, is not derived from hardware, and is stored in local configuration separately from telemetry’s installation identifier. Our server hashes the key and the install identifier and checks Dogger’s licence database, returning only whether the key is valid, a display customer name, and the Premium plan. We keep the hashed install identifier with first-seen and last-seen times so we can count distinct Dogger installs using a licence. Signed-in operational administrators can see that count. We do not impose an activation limit. Validation is necessary to provide and protect the Premium licence contract.

Recent validation can be reused for 24 hours. Stale credentials are checked at startup and periodically. Temporary failures do not expire a previously confirmed entitlement while its Keychain credential remains available; a confirmed rejection or Logout revokes Premium access immediately without deleting local project data.

4. AI features and external providers

Dogger supports bring-your-own-key requests to OpenAI, Anthropic, xAI, and OpenRouter. You choose which supported models are available and select a model for task generation, failed-run explanation, and cancelled-run analysis. Requests are made under the account associated with your credential. The selected provider’s terms, charges, controls, and retention practices apply independently. OpenRouter may route a request to the model provider identified in the selected model.

• Credential test: sends only the currently entered credential to the selected provider’s authenticated key or model-list endpoint. Testing does not save the credential.
• Dictation: sends the recorded audio clip, derived file name and media type, and transcription model to OpenAI. Dictation is OpenAI-only even when another provider supplies the selected text model.
• Task generation: may send task name, configured paths and runtime, prompts, attached images, prior conversation, the current task’s existing files, optional container-context AI instructions when set, and global library file names and bounded contents, including the bundled colour helpers, plus optional current-context tool file names and bounded contents. These files may be included initially or listed and read by the model through bounded read-only operations during generation or Fix Now. The model cannot change either helper library or list or read sibling tasks. Dogger applies pattern-based redaction for all configured AI credentials and common credential forms, but cannot guarantee removal of every secret or personal value.
• Failed-run explanation: sends bounded run metadata and output, conversation, and model-requested bounded codebase reads/searches. Dogger applies the same configured-credential and common-pattern redaction before provider requests, but cannot guarantee removal of every secret or personal value.
• Cancelled-run analysis: is off by default. If you enable it, cancellation may send task metadata, command, output, task files, and local Git status/diff evidence. This flow does not currently apply the shared credential redactor.

Use these features only with content you are authorised to send. Disable cancelled-run analysis or do not invoke an AI action when you do not want its described context sent.

5. Shared Projects and Git hosts

Shared Projects are opt-in. Dogger does not poll Git hosts, automatically apply or merge incoming content, or auto-push. Free and Premium users can add, clone, review, import, configure, apply incoming updates, and locally remove them; Premium adds publishing. Opening or refreshing Settings → Teams performs one bounded remote comparison for each connected repository. That check uses the same Git host, host Git or SSH credentials, and staging path as an explicit update: incoming content is staged for review and is not approved or applied until you choose to apply it. Authentication, offline, malformed-repository, and divergence results are shown without replacing usable local state.

For each Git network operation, the selected Git host receives the repository request, authentication supplied through your configured host Git or SSH credential facilities, and the repository content involved in that operation. Dogger does not store those credentials and does not accept repository URLs containing credentials. The Git host’s terms, access controls, logs, and retention apply separately.

Premium users can also create a personal GitHub repository through the GitHub CLI already signed in on the Mac. Dogger invokes that host gh tool against github.com with the repository name, optional description, and visibility you confirm. It does not run a GitHub login flow, accept a GitHub token, or store GitHub credentials. GitHub’s terms, access controls, logs, and retention apply separately. If GitHub creates the repository and a later local setup step fails, Dogger reports the repository URL and does not delete the remote. Connecting an existing Git repository does not require GitHub or the GitHub CLI.

Dogger stores checkouts, review state, imported task baselines, and materialized Shared Projects only below ~/.dogger. Incoming revisions remain staged until you review and approve them. Repository setup hints may prefill a local mapping form, but cannot choose host paths, select a live container, or grant local-execution trust. Those mappings, local aliases, private task overrides, tags, run history, and application settings stay on your Mac.

Premium portable project, context, and task edits in the ordinary app write the local approved checkout. They stay on your Mac until you explicitly publish from Settings → Teams; teammates receive them only after that confirmed publish, when they next open or refresh Teams. Free task-file edits remain private overrides and do not enter the shared checkout. Incoming updates compare local task files with the approved baseline. Remaining local-only overrides stay private; files changed locally and by the team require explicit conflict resolution. Publish is a Premium action. If unpublished local edits exist, Dogger commits them with a default message before asking you to confirm. Before push, Dogger warns that teammates can receive the revision. After a successful push, Dogger pulls from the same remote so the published revision can be synchronized; a teammate revision that arrived during publish remains staged until you review and apply it.

Installation-wide files in ~/.dogger/library are not Shared Project content. Dogger does not mirror or publish those files to a Git host or collaborators. Context helper files can still be portable Shared Project content when the project declares them.

Removing an imported project or disconnecting its repository deletes only the selected local checkout, mapping, baseline, and Shared Project records. It does not delete remote repository content or unrelated local projects. Legacy version 1 bindings become private local task snapshots; their repositories require an external upgrade and are not rewritten or pushed by Dogger.

6. Optional telemetry and explicit feedback

Product telemetry is off by default. If you explicitly enable it, Dogger records coarse events about application starts, use of named product features, and completed operations with success, failure or cancellation and a broad duration bucket. We use these events to understand feature adoption and improve product reliability.

Telemetry includes the Dogger version, macOS platform, optional processor architecture, the applicable schema and policy versions, and a random installation identifier. The identifier is generated by Dogger and is not derived from hardware, an account, a licence key, a path, or other user data. It is separate from the licence-install identifier used during Premium validation.

Default telemetry does not include task names or content, scripts, arguments, terminal output, logs, prompts, responses, file or repository paths, container names, licence keys, API credentials, feedback text, contact details, or other secrets. Dogger builds events from a closed allowlist rather than serialising application state.

You can review or change telemetry consent at any time under Settings → Feedback. The choice is a single on/off control. Disabling it stops new collection and discards telemetry still queued on your Mac. Delivery retries in the background. A changed schema or policy requires a current explicit choice before collection resumes.

In-app feedback is separate from telemetry and is sent only after you review the exact payload and choose Send. You may optionally provide an email address for a reply. App version and operating-system diagnostics are included with each submission and shown in that review. Feedback is pattern-redacted before it is queued, but you should still avoid including secrets or personal data that are not needed for your request.

When the service cannot be reached, consented telemetry is queued locally for up to 30 days and feedback for up to 90 days, subject to item-count and size limits. Delivery retries in the background and does not block local task workflows. Accepted submissions use random idempotency identifiers to avoid duplicate storage.

Our telemetry and feedback server validates strict bounded payloads and applies abuse controls. It does not store the request IP address with those submissions; a keyed, short-lived digest may be used for rate limiting. Telemetry is retained for up to 90 days and shown to operational administrators only as aggregate daily product metrics that meet a minimum distinct-installation threshold. Feedback is retained for up to 365 days and is available only for feedback triage. Administrator access uses a locally managed operational username and hashed password, short-lived secure sessions, and audited access and status changes; it is not a Dogger end-user or Premium account.

7. Website, updates, and support

• The website and its HTTPS infrastructure process normal request information such as IP address, time, requested path, user agent, and security/diagnostic data. The website does not use a third-party analytics beacon. First-party secure cookies are set only for operational administrator sessions when that area is enabled.
• If trusted-proxy rate limiting is enabled, a SHA-256 hash of the connecting address is held in process memory. Checkout windows last ten minutes; discount preview and licence-validation windows last one minute. Entries are then removed on cleanup, capacity eviction, or process restart.
• Update checks and direct downloads contact doggerapp.com. For each successful request for known release metadata, an installer, an updater archive or signature, or release notes, we retain the time, release version and file kind, IP address, and a length-limited User-Agent for about 90 days. This first-party operational download log is visible only to administrators. It contains no Dogger account, licence key, install identifier, cookie, or referrer and is not mixed into optional product telemetry or sent to a third-party analytics service. Homebrew installations also contact Homebrew and its package infrastructure.
• If you email support, we receive the address, message, and attachments you choose to send.

8. Why we use data

Depending on the activity, we process data to:

• perform the software, Premium, purchase-support, and validation contracts you request;
• pursue legitimate interests in securing, operating, troubleshooting, and preventing abuse of the website and licence service;
• process optional telemetry with your consent to improve Dogger, and handle feedback you explicitly submit to respond and plan improvements;
• answer support and rights requests; and
• meet legal, tax, accounting, or dispute obligations.

Optional AI actions occur only when you configure or invoke the relevant feature. Product telemetry remains disabled unless you allow it, feedback is sent only after review and confirmation, and Shared Project Git traffic occurs when you open or refresh Settings → Teams, after a confirmed publish, or when you otherwise request a Git or GitHub CLI action.

9. Recipients and international processing

Data may be handled by providers needed for the activity: Stripe for payment processing; Resend for licence email; OpenAI, Anthropic, xAI, or OpenRouter for the AI actions you choose; Homebrew for Homebrew-managed updates; the Git host you select for a Shared Project; GitHub.com when you create a personal repository through the host GitHub CLI; and our website-hosting, PostgreSQL database, reverse-proxy, deployment, email, and support infrastructure providers. Operational administrators may access download events, feedback, and thresholded aggregate metrics only for the purposes described above. Administrator sign-in credentials are stored locally as a password hash on our website database and are not verified by an external identity provider.

Some providers may process data outside the United Kingdom. Their own terms and privacy notices explain their locations and safeguards. We use providers for the stated purposes and do not sell personal data.

10. Retention and deletion

• Local Dogger data has no automatic age-based expiry. It remains until you delete the relevant item or local Dogger data. Deleting a task or project removes its nested history, but separately stored AI usage records are not automatically removed with it.
• Logout removes the saved Premium credential and entitlement metadata, not projects, tasks, settings, or history.
• Shared Project checkouts, mappings, baselines, and imported projects remain until you remove the relevant local project, disconnect its source, or remove local Dogger data. Local removal does not remove remote content.
• Local telemetry queue items expire after 30 days and local feedback queue items after 90 days. Disabling telemetry discards queued telemetry immediately. Submitted telemetry is deleted after 90 days and submitted feedback after 365 days under the normal retention schedule.
• Public release request events containing IP address and User-Agent are deleted after about 90 days under the normal retention schedule.
• Support emails are normally deleted 12 months after the request closes, unless they are still needed for an active dispute, security matter, or legal obligation.
• Dogger retains order and licence records while needed to provide and administer the licence, handle refunds or disputes, support accounting, and meet legal obligations. A refund or dispute can revoke the linked licence. Product-data retention remains separate; rate-limit buckets are removed after their short abuse-control window and by the daily retention job.
• External providers retain data under their own policies and account controls.

11. Your rights

Depending on applicable law, you may ask us for access, correction, deletion, restriction, objection, or portability of personal data we control, and may withdraw consent where consent is the basis. We may need to verify your request and may retain information where law permits or requires it.

Email [email protected] to exercise a right. You may also complain to the UK Information Commissioner’s Office or your local supervisory authority. Local data on your Mac is ordinarily controlled directly by you and may not be available to us.

12. Security and contact

We use measures appropriate to Dogger’s current architecture, including separate macOS Keychain entries for the Premium key and AI provider credentials, bounded server and Git operations, review-gated Shared Project adoption, allowlisted product-data schemas, least-privilege database roles, protected administrator sessions, no-store API responses, and redaction before feedback queue writes and applicable AI provider requests. No system is completely secure; review the feature-specific limits in this policy.

Questions about this policy can be sent to [email protected]. The related software terms are available in our Terms of Service.