“Your code stays on your device” deserves a clear explanation.
What stays local
Ecode doesn't receive or store your source file.
What the service receives
Our privacy policy lists:
- The file's SHA-256 fingerprint.
- File name, size, and registration date.
- Your IP address.
- Your email, if you provide it.
So the file contents stay local, but registration metadata is collected.
If a file name includes a client's name, consider a neutral name such as release.zip before registration.
Details: Ecode, under Privacy Policy.
Top comments (9)
respect for publishing the actual list instead of hiding behind "we take privacy seriously". the sharp edge is the fingerprint plus filename plus ip row, any one of them alone is fine, together they identify a person pretty reliably. curious whether the ip ever leaves the web server logs or if it sits in the same database as the fingerprints.
Thanks for pointing this out. That's a fair question. IP addresses remain in the server logs, but aren't stored with the file fingerprints or included in the certificate generated by the system.
fair, that answers the question. the sharp edge just moves to log retention then — do the web server logs have a stated retention window, or is that left to whatever the hosting default is?
Thanks for raising this. Privacy matters to us, and that includes how long server logs are kept. We appreciate the feedback on making this clearer.
appreciate the reply, but that's not quite an answer. is there a stated retention window, or is it whatever the hosting default is?
You're right, I should have given you a direct answer. Our normal server log retention period is one month. Specific entries may need to be kept longer where required by applicable EU or Member State law, or where lawfully necessary to investigate a security incident or handle a legal claim, and only for as long as necessary.
now that's an answer. one month default with narrow exceptions is about as tight as a company can reasonably go. worth putting that on the page so the next person doesn't have to ask three times like i did.
Cái phần "registration metadata" là điểm mình quan tâm nhất — device ID, timestamp, version client... nghe có vẻ nhẹ nhưng ghép lại đủ fingerprint một dev environment. Đặc biệt khi team dùng CI/CD shared runners, metadata đó có thể rò rỉ topology nội bộ nếu không strip kỹ.
Mình thấy pattern hay hiện nay là hash local file content trước khi quyết định gửi gì lên server (chỉ diff hash, không diff raw). Giảm payload, giảm rủi ro leak secret vô tình trong comment/code block. Có thấy Ecode áp dụng cách này không, hay vẫn ship full content cho lần đầu sync? (site: labagent .tech)
Thanks, that's a good point about metadata. Ecode calculates the file's SHA-256 fingerprint on your device. The file contents aren't uploaded, including during the first registration. The fingerprint and the registration metadata listed in our privacy policy are sent to the server. Keeping the code local doesn't mean no metadata is collected.