Privacy policy
Last updated 8 November 2026
Slydog is a feature flag service run by Is Life LLC, a Massachusetts company ("we", "us").
This policy covers the hosted service at api.slydog.dev and this website. It
explains what we store about you, why, who else handles it, and how to have it deleted.
The short version: we keep what we need to sign you in and run your flags. No ads, no tracking, and we never sell your data.
What we store and why
| What | Why |
|---|---|
| Your name, email address and profile picture from GitHub or Google, and your account ID there | To create your account, recognize you when you sign in again, and show who you are to the people you work with. |
| The sign-in tokens GitHub or Google send back when you sign in | Kept with your account. We ask only for your basic profile and email address, and we don't use these tokens to read anything else from your GitHub or Google account. |
| Sessions: a session token, when it expires, and the IP address and browser (user agent) it was created from | To keep you signed in, and to spot and investigate misuse. Signing out deletes the session. |
| Your organizations and roles | To decide what you can see and change. |
| The audit log: each change made in an organization, who made it (you, an API token, or Slydog itself), when, and the before and after | So the members of an organization can see what changed and who changed it. It's part of the service. |
| What you put into Slydog: apps, environments, flags, rules, segments, and any keys you target, such as your own users' IDs | To run your flags. See "Your users' data" below. |
| API tokens and SDK keys, stored only as a one-way hash plus the last four characters | To check requests from your servers, scripts and apps. |
Our servers also write operational logs (errors and background jobs) to help us keep the service running. Our hosting provider may record basic request details, such as IP addresses, for security and abuse prevention.
Your users' data
When your apps ask Slydog for flag values, they may send an evaluation context, such as a user ID or device ID. We use it to work out the answer and then discard it. We don't store it. Keys you add to targets or segments yourself are stored as part of your flags.
For that data you decide what to send, and we handle it only to run the service for you. Please don't put sensitive personal information, such as names, email addresses, health or financial details, in flag keys, targets or segments. Use opaque IDs instead.
Google user data
If you sign in with Google, we receive your name, email address and profile picture (the
openid, email and profile scopes) and use them only
for the purposes in the table above. Slydog's use and transfer of information received from
Google APIs adheres to the
Google API Services User Data Policy, including the Limited Use requirements. We don't use it for advertising, we don't sell
it, and we don't let people read it except as needed for security, to comply with the law,
or with your permission.
Cookies
The hosted service sets one cookie, which keeps you signed in, plus short-lived cookies during sign-in itself. This website sets no cookies, has no analytics, and loads nothing from other sites.
Who else handles your data
We use a few providers to run Slydog. They handle data only to provide their service to us.
- Railway runs our servers and database, in the United States.
-
Cloudflare serves this website, runs our DNS, and forwards email sent to
@slydog.devaddresses. - GitHub and Google sign you in, if you choose them. Their own privacy policies cover what they do.
We share data with others only when the law requires it, to protect people or the service from harm, or as part of a sale or merger of the business. If a sale or merger happens, this policy keeps applying to your data.
We store data in the United States. If you use Slydog from elsewhere, your data is transferred there.
How long we keep it
- Your account and sign-in details: until you delete your account.
- Sessions: until you sign out or they expire.
- An organization's flags, settings and audit log: as long as the organization exists. Audit entries keep the ID of the person who made a change, so the organization's history stays complete.
- Copies in backups are removed as those backups expire.
Your choices and rights
You can ask us to show you, correct, export or delete the data we hold about you. Email support@slydog.dev from the address on your account. We'll answer within 30 days. Deleting your account removes your profile, sessions and sign-in details. If you're the only owner of an organization, tell us whether to delete the organization too or hand it to another member.
You can also remove Slydog's access from your GitHub or Google account settings at any time. If you live in a place whose law gives you more rights, such as the EU, UK or California, we'll honor them, and you can complain to your local data protection authority.
Security
Everything is sent over HTTPS. Keys and API tokens are stored only as hashes. Organizations are kept separate from each other, and every request is checked against your role. No system is perfectly secure. If we learn of a breach that affects your data, we'll tell you promptly.
Children
Slydog is a tool for software teams and isn't meant for anyone under 16.
Changes
If we change this policy, we'll update the date at the top. If a change is significant, we'll email account owners before it takes effect.
Contact
Is Life LLC, Massachusetts, USA · support@slydog.dev