OpenThunder Privacy Policy
This Privacy Policy explains how Skills Tech Talk, LLC ("we," "us") handles information in connection with OpenThunder, including the desktop application, command-line tools, IDE extensions, plugins, and optional cloud features. It is a companion to the OpenThunder End User License Agreement, available at https://openthunder.dev/docs/eula.html.
The most important thing to know: OpenThunder is local-first. By default, your source code and analysis stay on your machine. We designed it so you can get real value without sending your code anywhere.
1. Our Local-First Principle
When you run OpenThunder on your machine, the analysis runs on your machine. The local application server binds to your loopback interface (localhost) and is not exposed to the internet. Your repositories, scans, findings, reports, and generated agent context are produced and stored locally by default.
We do not upload your source code to us by default. Data leaves your machine only when you take an action that requires it, such as enabling a cloud feature, signing in, configuring a third-party AI provider, exporting a report, or connecting a team integration. Those cases are described below.
2. Information We Process
Stays on your machine (we do not receive it by default):
- Your source code and repository contents
- Local scan results, findings, and reports
- AI prompts and context packs generated locally
- Local configuration and cached analysis
We receive it only when you opt in to a feature that needs it:
- Account and identity information. If you sign in, OpenThunder uses the shared Skills Tech Talk identity. We process your account identifier and email address to authenticate you and associate your entitlements. Sign-in is required only for cloud actions; local and desktop use does not require an account.
- Billing information. If you purchase a paid plan, checkout and payment are handled by Skills Tech Talk, LLC as merchant of record, or by its designated payment processor. We receive billing status and entitlement records. We do not receive or store your full payment card number; the payment processor handles card data under its own terms.
- License and entitlement records. We issue, renew, and revoke license or subscription records tied to your account to enforce plan access.
- Cloud scan data. If you enable cloud or team features, OpenThunder may transmit repository metadata, scan results, findings, file paths, commit metadata, reports, quality gate status, AI Security findings, PR evidence, and configuration data. By default, cloud features are designed to send results and metadata, not raw source code. Raw source is sent only if a specific feature, hosted scan, enterprise configuration, or explicit action requires it, and you are responsible for reviewing settings and export previews first.
- Telemetry. If enabled or permitted by your settings, we may collect limited diagnostic or usage telemetry (such as feature usage, errors, and performance signals) to improve OpenThunder. Telemetry does not include raw source code by default. Where practical, OpenThunder provides settings to disable non-essential telemetry.
- Support communications. If you contact us, we process what you send us to respond.
3. Third-Party AI Providers
OpenThunder can integrate with third-party AI providers (such as Anthropic's Claude, or other models) if you configure them. When you use a configured AI provider, the prompts and context OpenThunder sends are processed by that provider under its own terms and privacy policy, not ours. You choose whether to configure a provider and what to send. We are not responsible for a third-party provider's data handling, output, availability, or cost. Review each provider's terms before enabling it.
4. Third-Party Processors We Use
To operate the paid and cloud features, we rely on service providers that process data on our behalf, which may include:
- Hosting and infrastructure for the cloud API and web application.
- Identity through the shared Skills Tech Talk sign-in.
- Payments through our merchant-of-record and payment processor.
- AI providers only where you have configured them.
- Analytics (Google Analytics) for anonymous, aggregate usage of our public websites only. Configured privacy-first: IP anonymization on, advertising features and Google Signals off.
These providers process data only to provide their service to us and are expected to maintain appropriate safeguards. This is not an exhaustive list; we may add or change providers as the product evolves.
5. How We Use Information
We use the information we receive to:
- Authenticate you and provide account and cloud features.
- Issue and enforce licenses and plan limits, and prevent abuse.
- Process purchases, renewals, and cancellations.
- Operate, maintain, secure, and improve OpenThunder.
- Provide support and respond to your requests.
- Comply with legal obligations and enforce our terms.
We do not sell your personal information. We do not use your source code to train models, and OpenThunder is built so your code does not reach us in the first place unless you send it through an opt-in feature.
6. Cookies and Local Storage
The OpenThunder cloud web application uses essential browser storage (such as localStorage and cookies) to keep you signed in and to remember acceptance of our terms. These are necessary for the app to function.
On our public websites (openthunder.dev and openthunder.ai) we use Google Analytics for anonymous, aggregate usage: page views and download counts. It is configured privacy-first: IP addresses are anonymized, and advertising features, ad personalization, and Google Signals (cross-site ad profiling) are disabled. We do not use advertising or cross-site ad-tracking cookies, and we do not sell or share this data. Analytics run only on our websites; they are never included in the desktop app, the CLI, or the VS Code extension.
7. Data Retention
We retain account, license, billing, and cloud scan records for as long as your account is active and as needed to provide the service, comply with legal, tax, and accounting obligations, resolve disputes, and enforce our agreements. Local data on your machine is under your control and is retained until you delete it. Telemetry is retained only as long as needed for the purposes above.
8. Your Choices and Rights
Depending on where you live, you may have rights to access, correct, delete, or export your personal information, or to object to or restrict certain processing. Because OpenThunder is local-first:
- You can avoid sending most data to us simply by using local features without an account.
- You can disable non-essential telemetry in settings where available.
- You can choose whether to configure third-party AI providers.
To make a rights request about information we hold, contact us at the address below. We will respond as required by applicable law. We may need to verify your identity before acting on a request.
9. Security
We use reasonable administrative, technical, and organizational measures designed to protect information we process. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for safeguarding your own machine, credentials, backups, and repositories, and for reviewing what you export or transmit.
10. International Transfers
We and our service providers may process information in the United States and other countries. Where required, we rely on appropriate safeguards for cross-border transfers.
11. Children
OpenThunder is a professional developer tool and is not directed to children. We do not knowingly collect personal information from children under the age required by applicable law. If you believe a child has provided us information, contact us and we will take appropriate steps.
12. Changes to This Policy
We may update this Privacy Policy from time to time. If changes are material, we may provide notice through the website, application, email, or other reasonable means. The Effective Date above shows when this version took effect. Continued use after an update means you accept the updated policy.
13. Contact
Questions or privacy requests may be sent to:
Skills Tech Talk, LLC Email: support@skillstechtalk.com