Privacy

Who is responsible

The data controller is React Consulting SARL AU, a company established in Morocco, represented by its manager Jordan Monier, which publishes Pupitre. Write to privacy@pupitre.studio for anything about your data; we answer within thirty days.

For the data an organisation entrusts to us about its members and its machines, we also act on behalf of that organisation, as the data processing agreement says.

What we store

Your account. Your email address, your name if you give one, your language, and the way you sign in: a link sent by email, a GitHub or Google account — from which we receive the email address and the name they share, and nothing else —, a passkey, or a second factor. Each sign-in session keeps its IP address and the identifier of the browser or the app it came from.

Your devices. The name of each computer you linked the app from, and the public half of the SSH key it generated. The private half stays on that computer; we never see it. When one of your devices allows another device on a machine, the approval it signs: the machine, the allowed public key, the user who holds it, the date, the fingerprint of the signing key and the signature, kept as long as the machine and both devices exist.

Your organisation. Its name, its members and their roles, its invitations, and a journal of what was done in it: who enrolled, removed, suspended or restored a machine, invited or removed a member, with the date.

Your machines. What the terms list, and nothing else: the name and address you gave each machine, the public half of its SSH host key, the agent version, the processor architecture, the account that holds the SSH keys, the state of its right of use, and — refreshed every five minutes and kept as a seven-day window — its disk size and free space, its memory size and use, its load average, the version of the installed stack, the names of the installed modules, the fingerprints of the SSH keys the agent trusts and of those waiting for an approval, and the names of the running tmux sessions, which are usually the names of your projects.

Your backups. When you turn them on, a reference for each backup, as the terms list it: its date, its place in your own storage (endpoint, region, bucket, object prefix), the digest of its manifest, its size, what it holds in numbers — never in names —, the configuration revision, the agent version, the public key it is encrypted to and its salt, and the name you give a backup you start yourself, if you give one; with the heartbeat, the backup interval and the outcome of the last attempt; and, when you restore one, on which machine. The backup itself lives in your storage, encrypted to a key only your passphrase gives; we never receive it, and nobody keeps the passphrase. The access key to your storage stays in your computer’s keychain and on your machine: the platform never receives it and refuses a reference that would carry it. A reference is kept until the machine deletes the backup or an administrator of your organisation forgets it.

Your licence. How many machines your organisation enrolled and, when it holds a licence beyond the free servers, its number of seats, its dates and who granted it. No payment data exists, because nothing is paid.

What you write to us. Every email sent to an address at pupitre.studio is stored on the platform — its text, its headers and its attachments — and read by the team from the console, where each reading of a sensitive thread is itself journaled.

Where you came from. When you arrive through an affiliate link (?ref=), the link’s code is kept for 90 days in the pupitre_ref cookie on pupitre.studio, so the console can note which link brought you when you create your account. It holds nothing but that code, it is sent to nobody else, and without that parameter it is never set. The platform also counts one visit for that link, once per browsing session, keeping nothing about you, and, for each link, how many machines the organisations it brought have enrolled. That note only says where you came from: no offer, price or reward is attached to it.

Everything the site and the console write to your browser is described in the cookie policy.

What we never store

No code, no project file, no service secret, no application log, no terminal content, no environment variable, no database content, no private key. What lives on your machine stays on your machine: the platform has no technical means of fetching it, as the terms explain.

Why, and on what basis

• To provide the service, that is to perform the contract the terms form: your account, your devices, your organisation, your machines, your backups, your licence and the emails that make the account work.
• To protect the service and the organisations, on the basis of our legitimate interest: the IP address and the device of each session, the journal of each organisation, the journaling of readings of sensitive threads.
• To answer you, on the basis of our legitimate interest, or to prepare the contract you ask us for: the emails you write to us.
• To know which link brought you, on the basis of our legitimate interest: the affiliate code and the visit count of a link.
• To count the visits of the site and the console, on the basis of our legitimate interest, without a cookie, without an identifier and without telling one visitor from another, as described under Audience measurement.
• To store and process all of the above at Cloudflare, in the United States, on the basis of your explicit consent, given when you create your account, as described under Where your data goes and Transfers outside Morocco and the European Union.
• To comply with the law: keeping what the law obliges us to keep, and answering the authorities that may lawfully ask.

No decision about you is made by automated processing alone, except what the contract itself provides: a machine without a valid right of use enters restricted mode.

Audience measurement

On the site, visits are counted with Cloudflare Web Analytics. Each page loads a small script from Cloudflare, which sends Cloudflare the address of the page, the page you came from, the type of your browser and of your device, and how long the page took to display. The script writes nothing to your browser — no cookie, no local storage — and carries no identifier: a visit cannot be tied to the next one, nor to you, nor to your account. Cloudflare receives, like any server, the IP address of the request; it may derive the country from it, then discards it in the data centre that received it, without storing it. We only see totals: pages viewed, countries, referring sites, browsers. Since nothing is written to your browser and nobody is identified, the site shows no consent banner for it.

The console counts its page views with the same Cloudflare Web Analytics, on the same terms: nothing written to your browser, no identifier, never joined to your account, never what a page shows.

The desktop app sends nothing to a measurement tool today. If the console or the app starts measuring which actions are taken, it will be on the same terms — event names and technical context, never a content, never anything from your machines, never an identifier without your consent — and this page will say so with its date.

We use no advertising network, no advertising cookie, and we never sell or share data with a third party for its own purposes.

Transactional email

We send what makes the account work: address confirmation, sign-in link, invitation to an organisation, alert about a machine, notice about your licence or about a change to these documents. Those cannot be turned off while the account exists. Any other message — news, tips — is turned off in one click from the message itself.

Payments

Nothing is paid, and no payment data exists. Should paid licences be offered one day, this page will say first who collects the payments and what we keep of them, and the change will be announced by email at least thirty days ahead.

Sub-processors

Sub-processor	Purpose	Region
Cloudflare, Inc.	Hosting of the site and the console, platform database (accounts, organisations, servers, licences, journal), storage of binaries and attachments, inbound and outbound email, audience measurement without a cookie or an identifier (Web Analytics)	United States company, global network; the database and the files in eastern North America
Stripe, Inc.	Merchant of record for licences beyond the free servers, the day they are sold; nothing is sent to it today	United States and Ireland

Adding a sub-processor is announced by email to the owners of every organisation before it happens, and the list of sub-processors records it with its date.

Where your data goes

In plain words: everything the platform keeps is stored and processed by Cloudflare, a company of the United States. That means your account and your sessions, your devices and their public keys, your organisation, its members and its journal, the metadata of your machines and every heartbeat they send, the references of your backups, your licence, the emails you send us and those we send you, and the platform’s technical logs. The database and the files are stored in Cloudflare’s Eastern North America region; each request first goes through the Cloudflare data centre nearest to you. The site you are reading and the console are served by Cloudflare too, and their audience is measured by Cloudflare. The team reads the platform’s data from Morocco.

Two other companies receive something only if you choose them: GitHub or Google, when you sign in through one of them. They then learn that you signed in to Pupitre, and process it under their own policies. Stripe receives nothing today. No other company receives your data.

Transfers outside Morocco and the European Union

Storing your data at Cloudflare, in the United States, is a transfer of your data outside Morocco and outside the European Union, to a country whose law does not give it the same protection as Moroccan law 09-08 or the European Union’s General Data Protection Regulation.

That transfer rests on your explicit consent. The sign-in page says where your data goes before you type your email address. Your account is created when you first open your sign-in link, or come back from GitHub or Google; before you can use anything, the console asks you to agree that your data is stored and processed by Cloudflare in the United States, as this page describes. We record that consent with its date and the version of the text you agreed to; when the text changes, you are asked again. If you decline, the account that sign-in just created is deleted at once, because the platform has no other place to run. You withdraw it by deleting your account from the console: everything is then deleted as Retention describes, and your machines keep running. Withdrawing does not make unlawful what was done before.

When an organisation established in the European Union or the United Kingdom entrusts its members’ data to us, the transfer also relies on the standard contractual clauses the data processing agreement incorporates. Between us and Cloudflare, the transfer is also covered by the data processing terms and the clauses Cloudflare publishes.

Retention

Your account and your organisation are kept while the account exists. Deleting the account from the console deletes it immediately, with your devices and their public keys; a deletion we perform at your request or as a sanction is scheduled seven days ahead, so that a mistake can be undone, then carried out. Sign-in sessions expire after sixty days. Machine metrics are a sliding window of seven days. The journal of an organisation is kept with the organisation; when an account is deleted, its lines lose their author. Emails you sent us are kept as long as the exchange may still be needed to help you, and deleted on request. The audience measurement holds no IP address and no identifier; Cloudflare keeps its detailed counts for seven days, then only a sample of them, and they are never joined to your account.

Your rights

You can see, correct, export and have your data deleted, restrict its processing, object to a processing that is based on our legitimate interest, and withdraw a consent you gave at any time, without affecting what was done before. Deleting the account is done from the console and takes your devices with it; your machines keep running. For anything else, write to privacy@pupitre.studio; we may ask you to prove the address is yours before acting on it.

You may also complain to a supervisory authority: in Morocco, the Commission nationale de contrôle de la protection des données à caractère personnel (CNDP); in the European Union or the United Kingdom, the authority of your country. If you live in California or in another US state that gives you similar rights, you have the same rights as above, we do not treat you differently for using them, and we do not sell or share your data as those laws define it.

Age

The service is meant for professionals and adults. We knowingly open no account to a person under sixteen; write to us if one exists and we delete it.

Security

Encryption in transit and at rest, sign-in by link, passkey or second factor, sessions bound to the device that opened them, access to production restricted to the people who need it and journaled, secrets kept out of the code, agent distributed as a signed binary, and no inbound connection to your machines. A breach that affects you is announced to you without undue delay. The security policy says how to report a vulnerability to us.

Changes

A change to this policy is published on this page with its date, and announced by email to active accounts when it widens what we collect or what we do with it.