OpenThunder Privacy Policy
This Privacy Policy explains how Skills Tech Talk, LLC ("we," "us") handles information in connection with OpenThunder, including the desktop application, command-line tools, IDE extensions, plugins, and optional cloud features. It is a companion to the OpenThunder End User License Agreement, available at https://openthunder.dev/docs/eula.html.
The most important thing to know: OpenThunder is local-first. By default, your source code and analysis stay on your machine. We designed it so you can get real value without sending your code anywhere.
1. Our Local-First Principle
When you run OpenThunder on your machine, the analysis runs on your machine. The local application server binds to your loopback interface (localhost) and is not exposed to the internet. Your repositories, scans, findings, reports, and generated agent context are produced and stored locally by default.
We do not upload your source code to us by default. Data leaves your machine only when you take an action that requires it, such as enabling a cloud feature, signing in, configuring a third-party AI provider, exporting a report, or connecting a team integration. Those cases are described below.
2. Information We Process
Stays on your machine (we do not receive it by default):
- Your source code and repository contents
- Local scan results, findings, and reports
- AI prompts and context packs generated locally
- Local configuration and cached analysis
We receive it only when you opt in to a feature that needs it:
- Account and identity information. If you sign in, OpenThunder uses the shared Skills Tech Talk identity. We process your account identifier and email address to authenticate you and associate your entitlements. Sign-in is required only for cloud actions; local and desktop use does not require an account.
- Billing information. If you purchase a paid plan, checkout and payment are handled by Skills Tech Talk, LLC as merchant of record, or by its designated payment processor. We receive billing status and entitlement records. We do not receive or store your full payment card number; the payment processor handles card data under its own terms.
- License and entitlement records. We issue, renew, and revoke license or subscription records tied to your account to enforce plan access.
- Cloud scan data. If you enable cloud or team features, OpenThunder may transmit repository metadata, scan results, findings, file paths, commit metadata, reports, quality gate status, AI Security findings, PR evidence, and configuration data. By default, cloud features are designed to send results and metadata, not raw source code. Raw source is sent only if a specific feature, hosted scan, enterprise configuration, or explicit action requires it, and you are responsible for reviewing settings and export previews first.
- Telemetry. Usage telemetry is off unless you turn it on. In the desktop app, usage sharing is off by default; if you turn on Share which features you use in Settings, the app sends only the name of each feature you use (for example, opened a repository or ran a Check), the app version, and the day. In the command-line tools, anonymous usage statistics are sent only if you opt in (
openthunder telemetry onorOPENTHUNDER_TELEMETRY=1); they contain event names, coarse counts, a random install identifier, and a one-way repository token that cannot be turned back into a repository name or path. Telemetry never includes your source code, file names or paths, repository names, prompts, or email address. Local Only mode turns all telemetry off. You can turn it off at any time, and sending stops at once. - Support communications. If you contact us, we process what you send us to respond.
3. Third-Party AI Providers
OpenThunder can integrate with third-party AI providers (such as Anthropic's Claude, or other models) if you configure them. When you use a configured AI provider, the prompts and context OpenThunder sends are processed by that provider under its own terms and privacy policy, not ours. You choose whether to configure a provider and what to send. We are not responsible for a third-party provider's data handling, output, availability, or cost. Review each provider's terms before enabling it.
4. Third-Party Processors We Use
To operate the paid and cloud features, we rely on service providers that process data on our behalf, which may include:
- Hosting and infrastructure for the cloud API and web application.
- Identity through the shared Skills Tech Talk sign-in.
- Payments through our merchant-of-record and payment processor.
- AI providers only where you have configured them.
- Analytics (Google Analytics) for aggregate usage of our public websites and the OpenThunder Cloud web app, only after you choose to allow it. Configured privacy-first: IP anonymization on, advertising features and Google Signals off.
These providers process data only to provide their service to us and are expected to maintain appropriate safeguards. This is not an exhaustive list; we may add or change providers as the product evolves.
5. How We Use Information
We use the information we receive to:
- Authenticate you and provide account and cloud features.
- Issue and enforce licenses and plan limits, and prevent abuse.
- Process purchases, renewals, and cancellations.
- Operate, maintain, secure, and improve OpenThunder.
- Provide support and respond to your requests.
- Comply with legal obligations and enforce our terms.
We do not sell your personal information. We do not use your source code to train models, and OpenThunder is built so your code does not reach us in the first place unless you send it through an opt-in feature.
6. Cookies and Local Storage
The OpenThunder cloud web application uses essential browser storage (such as localStorage and cookies) to keep you signed in and to remember acceptance of our terms. These are necessary for the app to function.
Google Analytics is optional and asks first. On our public website (openthunder.dev) and in the OpenThunder Cloud web app (app.openthunder.ai), Google Analytics does not load, sets no cookies, and sends nothing until you choose Allow analytics. Keep analytics off is just as easy, and every feature works with analytics off. If your browser sends a Global Privacy Control or Do Not Track signal, analytics stay off and we do not ask. Your choice is saved in your browser; use Analytics choices on the website, or Privacy choices in the Cloud app (in Settings and on the sign-in screen), to change it at any time. Withdrawing stops sending immediately and removes the analytics cookies.
When you allow it, Google Analytics counts page visits by page type (for example, Settings or Repositories) and, on the website, entry clicks such as Download. It does not receive your email, account or user identifier, repository names, file paths, code, search terms, or the full web address (query strings and fragments are never sent). It is configured privacy-first: IP addresses are anonymized, Google Consent Mode keeps advertising storage and ad signals denied, and advertising features, ad personalization, and Google Signals (cross-site ad profiling) are disabled. We do not use advertising or cross-site ad-tracking cookies, and we do not sell or share this data. Google Analytics never runs in the desktop app, the command-line tools, or the VS Code extension.
7. Data Retention
We retain account, license, billing, and cloud scan records for as long as your account is active and as needed to provide the service, comply with legal, tax, and accounting obligations, resolve disputes, and enforce our agreements. Local data on your machine is under your control and is retained until you delete it. Telemetry is retained only as long as needed for the purposes above.
8. Your Choices and Rights
Depending on where you live, you may have rights to access, correct, delete, or export your personal information, or to object to or restrict certain processing. Because OpenThunder is local-first:
- You can avoid sending most data to us simply by using local features without an account.
- You can keep usage sharing off, or turn it off at any time: in the desktop app with Share which features you use in Settings, in the command-line tools with
openthunder telemetry off, and in the Cloud web app or on our website with Privacy choices or Analytics choices. - You can choose whether to configure third-party AI providers.
Deleting your data yourself. You do not need to ask us to delete what OpenThunder stores. On the Repositories page of the application:
- Delete repository data removes everything OpenThunder stored about one repository: Checks and their proof, tasks and their activity, share links, codebase answers, architecture notebooks, health reports, cached analyses, and the team scan records for that repository where you are an administrator. The repository folder on your computer is never deleted, and files your team committed are not touched. You get a receipt listing what was deleted and anything that was kept, with the reason.
- Delete my OpenThunder account and data deletes every repository you added and all data derived from it, your workspace, API keys, invites, preferences, cloud organizations that only you belong to, your membership in other organizations, and your OpenThunder account record, then signs you out. Where you are the only administrator of a workspace or organization that other people still use, deletion is held until you hand it over or remove the other members.
Two things are kept, and we say so in the receipt: your shared Skills Tech sign-in (deleting your OpenThunder account does not delete your Skills Tech Talk account; signing in again starts a fresh, empty OpenThunder account), and billing, license, and purchase records we must retain under tax and accounting law.
For anything else, including access or export requests, or deletion of records you cannot reach from the application, contact us at the address below. We will respond as required by applicable law. We may need to verify your identity before acting on a request.
9. Security
We use reasonable administrative, technical, and organizational measures designed to protect information we process. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for safeguarding your own machine, credentials, backups, and repositories, and for reviewing what you export or transmit.
10. International Transfers
We and our service providers may process information in the United States and other countries. Where required, we rely on appropriate safeguards for cross-border transfers.
11. Children
OpenThunder is a professional developer tool and is not directed to children. We do not knowingly collect personal information from children under the age required by applicable law. If you believe a child has provided us information, contact us and we will take appropriate steps.
12. Changes to This Policy
We may update this Privacy Policy from time to time. If changes are material, we may provide notice through the website, application, email, or other reasonable means. The Effective Date above shows when this version took effect. Continued use after an update means you accept the updated policy.
13. Contact
Questions or privacy requests may be sent to:
Skills Tech Talk, LLC Email: support@skillstechtalk.com