Privacy Policy
Effective October 1, 2026
Lilytrap plants decoys in your build output and alerts you when an AI agent follows them. This policy explains what we collect to do that. The short version: we never receive your source code or your build output.
What we never collect
- Your source code. The GitHub Action runs inside your own CI.
- Your build output or artifacts. Decoys are added on your runner, not on our servers.
- Access to your repositories. We don't ask for repository read or write permission.
What we collect
Account information
Your email address and a hashed password, or the email address your sign-in provider shares with us. Sign-in providers are Google, Apple and GitHub. From GitHub we also read your user ID, username and public profile name. We don't store provider access tokens.
Build metadata
When the GitHub Action runs, it sends your repository name, commit SHA, workflow run ID and one-way hashes of the decoys it planted. We use these to tell you which build a caught agent came from.
Infrastructure decoys
If you plant decoys in your infrastructure, we receive their names and hashes. That means secret names, parameter names, file paths and the decoy access key ID. If you turn on read detection, your cloud account or host sends us audit-log entries for those decoys only. Each entry includes the identity, IP address and user agent that touched the decoy.
Trap events
When something follows a decoy, we record that request. This includes its IP address, user agent, headers, URL, and the first 2 KB of its body. These requests come from whoever is probing your software, not from you. We use them to classify the visitor and to alert you.
Settings you give us
Alert destinations you configure, such as a Slack webhook, an alert email address, a PagerDuty key, a webhook URL and signing secret, or a GitHub repository for hand-off. Also the identities you mark as your own, so they never alert. Secrets are write-only in the dashboard.
Billing
Payments are handled by Stripe. We store your Stripe customer and subscription IDs and your plan. We never see or store your card number.
How we use it
- To run the service: match trap events to your workspace and send your alerts.
- To secure the service: detect abuse and investigate incidents.
- To bill paid plans.
- To contact you about your account or important changes.
We don't sell personal information. We don't use it for advertising. The site runs no analytics or advertising trackers.
Who we share it with
We share data only with providers that run Lilytrap for us:
- Amazon Web Services: hosting, database, sign-in and alert email (United States, us-east-2).
- Stripe: payments.
- Google, Apple and GitHub: only if you choose to sign in with them.
- Slack, PagerDuty, webhooks or GitHub: alerts go only where you send them.
We may disclose information if the law requires it.
How long we keep it
- Trap events and builds: for as long as your workspace exists.
- Events that match no workspace: 7 days.
- Unused workspace claim codes: 30 days.
- Server logs: 14 days.
Close your workspace and we delete its data within 30 days. Billing records may be kept longer where the law requires.
Cookies and storage
The dashboard keeps your sign-in session in your browser. Our sign-in page sets the cookies it needs to keep you signed in. We use no tracking cookies.
Security
Data is encrypted in transit and at rest. Access inside our systems is limited by role. No method of storage or transmission is perfectly secure, but we work to protect your data.
Your rights
You can access, correct, export or delete your personal information. Email us and we'll respond within 30 days. Depending on where you live, you may have more rights. These include rights under the GDPR and the CCPA, and the right to complain to a regulator.
Children
Lilytrap is for software teams. It isn't directed at anyone under 16, and we don't knowingly collect their data.
Changes
If we change this policy in a meaningful way, we'll update the date above and tell account owners by email.
Contact
Questions or requests: privacy@lilytrap.com.