privacy policy.
Effective: May 26, 2026
the cli runs on your machine. we never see your data.
satus is a command-line tool. It reads your Postgres schema, talks to the LLM provider whose API key you supply, and writes rows back to your database—all on your machine. PasskeyBridge LLC, the operator of satus.sh, never sees your schemas, the rows generated, the prompts sent to your LLM, or the contents of your database.
The only personal data we collect is what passes through the satus.sh website: the email address you give us to receive a license key, the billing data Stripe needs to charge your card, and a small amount of aggregate web analytics. That’s it.
passkeybridge llc, a wyoming company.
satus.sh is operated by PasskeyBridge LLC, a Wyoming limited liability company located at 5830 E 2nd St., Ste 7000 #33652, Casper, WY 82609. For the purposes of GDPR, we are the data controller for the data described in this policy.
four buckets. nothing about your database.
Account & billing. When you purchase a license we collect your email address and the billing data Stripe requires (name, country, last four digits of card, billing address). Full card numbers are processed by Stripe and never reach our servers.
License telemetry. The CLI sends your license key to /api/public/license/verify to confirm it is valid. The verification request includes only the license key and a generic User-Agent string. To rate-limit abuse, the request IP is hashed in memory (SHA-256, truncated) for the lifetime of the Worker isolate and discarded; we do not persist your IP, your machine ID, or any project metadata against your key.
Run telemetry. Off unless you turn it on. As of CLI v0.3.11 nothing is sent unless telemetry.enabled is true in satus.config.json or SATUS_TELEMETRY=1 is set; DO_NOT_TRACK=1 overrides both and always wins. satus init asks, and defaults to no.
When it is enabled, a finished satus generate posts one record to /api/public/cli/run. As of CLI v0.3.7 that record contains a random run UUID, the CLI version, the provider and model name, the profile name, the number of tables touched, the total row count, the token totals, the estimated spend, the duration, and—on failure—a fixed-vocabulary error class such as pg_23505 or provider_http_429. It contains no table names, no column names, no schema name, no row data, and no raw error text. The request fails silently if it cannot reach us; it never blocks or breaks a run.
CLI versions 0.2.0 through 0.3.6 additionally sent the list of table names, the target schema name, and the raw error message—which, for a Postgres unique violation, embeds the offending row value. That contradicted the promise on this page and in the CLI README. v0.3.7 stops sending those three fields, and the ingest endpoint now discards them from any payload an older CLI still sends, so the promise holds regardless of which version is installed. The only records ever collected under the old behaviour were our own release-test runs.
Separately: through CLI v0.3.10 the run record was sent unconditionally, with no way to turn it off, while our security page said telemetry was off by default. Only the optional failure-fingerprint sharing was ever gated. Nothing identifying was collected in that window—the payload was already the minimal one described above, and all twelve records in the table are our own release-test runs—but the published sentence described behaviour the CLI did not have. v0.3.11 makes the run record opt-in, which is what the page always claimed.
Web analytics. The marketing site uses Ahrefs Web Analytics, a cookieless analytics product that records aggregate pageviews and referrer domains. It does not set tracking cookies, does not build a profile of you, and does not identify you across sites.
What we do not collect. We never receive your database schema, connection string, generated rows, LLM prompts, LLM responses, or LLM API key. None of those ever leave your machine.
contract performance and legitimate interest.
We process the data above under the following GDPR lawful bases:
- Contract performance (Art. 6(1)(b)): account email and billing data, to deliver your license and process payment.
- Legitimate interests (Art. 6(1)(f)): license verification and aggregate analytics, to operate the Service and prevent license abuse.
- Consent (Art. 6(1)(a)): any future marketing emails (opt-in only).
a short, named list.
We use the following sub-processors to operate the Service:
- Stripe, Inc.—payment processing. Privacy policy.
- Cloudflare, Inc.—hosting, edge runtime, and DDoS protection for satus.sh.
- Supabase, Inc.—database hosting for license records and transactional email infrastructure.
- Ahrefs Pte. Ltd.—cookieless web analytics.
We will notify customers by email at least 30 days before engaging a new sub-processor that has access to personal data.
only as long as needed.
License records (email, license key, purchase date) are retained for the duration of your active subscription plus seven (7) years thereafter to satisfy U.S. tax-record obligations. Aggregate analytics data is retained for 14 months. Transactional emails are retained for 90 days for delivery-troubleshooting purposes, then purged.
international, governed by sccs.
We are based in the United States and our sub-processors operate globally. Transfers of personal data from the EEA, UK, or Switzerland to the United States rely on the European Commission’s Standard Contractual Clauses (SCCs) and, where applicable, on Stripe’s and Cloudflare’s certification under the EU–U.S. Data Privacy Framework.
access, erase, port, object.
Depending on your jurisdiction you have the right to:
- Access the personal data we hold about you (GDPR Art. 15, CCPA §1798.100, PIPEDA Principle 9).
- Rectify inaccurate data (GDPR Art. 16).
- Erase your data, subject to legal retention obligations (GDPR Art. 17, CCPA §1798.105).
- Port your data to another service (GDPR Art. 20).
- Object to processing based on legitimate interests (GDPR Art. 21).
- Withdraw consent at any time (GDPR Art. 7(3)).
- Non-discrimination for exercising your rights (CCPA §1798.125).
To exercise any of these rights, email support@satus.sh. We respond within 30 days (45 days for CCPA requests). California residents may designate an authorized agent in writing. EU residents may also file a complaint with their local supervisory authority; Canadian residents may file a complaint with the Office of the Privacy Commissioner of Canada.
not directed at anyone under 16.
satus is a developer tool intended for use by adults in a professional context. We do not knowingly collect personal data from anyone under 16. If you believe a minor has provided us with personal data, contact us and we will delete it.
encrypted in transit and at rest.
All traffic to satus.sh and to /api/public/license/verify is served over TLS. License records are stored in an encrypted Postgres database; payment data is held by Stripe (PCI-DSS Level 1). For coordinated vulnerability disclosure, scope, and the embargo timeline, see our security policy.
we’ll notify you of material changes.
We may update this policy from time to time. Material changes will be announced by email to the address associated with your license at least 30 days before they take effect. The current version is always available at this URL with an updated effective date.
one address. a human reads it.
PasskeyBridge LLC
5830 E 2nd St., Ste 7000 #33652
Casper, WY 82609
United States
Email: support@satus.sh
Web: satus.sh