Privacy
What we collect, why we collect it, and how to make us stop. Last updated 31 July 2026.
Who is responsible
Carrick is operated by Far Harbour B.V., the data controller for everything described here.
- Far Harbour B.V.
- Amsterdam, Netherlands (registered address on file at KvK)
- KvK 76438503 · VAT NL860623427B01
- [email protected]
What we collect
When you visit the site
We use PostHog, hosted in the EU, to count visits and see which pages get read. Unless you accept cookies, this is anonymous: PostHog works out a one-way hash on its own servers, throws away the ingredients the same day, and stores no cookie, no profile, no IP address and no location. Visits are counted but nothing links one to the next. If you accept cookies, a cookie is stored and your visits are linked together over time. The cookie policy lists exactly what is set.
When you contact us or apply
The contact, apply and newsletter forms collect what you type into them: your email address, and depending on the form your company name, GitHub organisation, repository names, team size, which coding agents you use, and any message you write. We use it to reply to you and, if you asked for it, to send you occasional product email.
When you use the dashboard
Signing in with GitHub gives us your GitHub login and the email address on that account, which we store to identify you. We also record which repositories you connect so Carrick can scan them. We count page views in the dashboard to see which features get used.
Why we are allowed to
- To run the service you signed up for (Article 6(1)(b)). Your account, your connected repositories, and the scans you ask for.
- Our legitimate interest (Article 6(1)(f)) in understanding how the site and product are used, so we can improve them. This covers analytics and the emails you send us. We keep it to what is needed for that and you can object at any time, see below.
- Your consent (Article 6(1)(a)) for analytics cookies and for marketing email. You can withdraw it at any time and it is as easy to withdraw as it was to give.
Who else sees it
We do not sell your data and we do not share it for anyone else's advertising. We use these processors, each under a data processing agreement:
- PostHog — product and website analytics, hosted in the EU.
- Cloudflare — hosting, CDN and security for this site.
- Amazon Web Services — the dashboard and its database, hosted in the EU (Ireland).
- Resend — sends our transactional and newsletter email, and stores subscriber addresses.
- Crisp — the chat widget on this site.
- GitHub — sign-in, and the source of the repository data you ask us to scan.
- Google Fonts — serves the fonts on this site, which discloses your IP address to Google.
Some of these are based outside the EU. Where data leaves the EEA it is transferred under the European Commission's standard contractual clauses or an adequacy decision.
How long we keep it
- Analytics — 12 months.
- Emails you send us — while we are in contact, and deleted on request.
- Newsletter subscription — until you unsubscribe.
- Account data — while your account exists, then deleted within 30 days.
Your rights
You can ask us for a copy of your data, to correct it, to delete it, to restrict what we do with it, or to receive it in a portable format. You can withdraw consent at any time.
You can object to analytics. Where we rely on legitimate interest, you have the right to object under Article 21. The quickest way is the opt-out page, which stops analytics loading in your browser entirely. You can also email us and we will action it.
Email [email protected] for any of the above. If you are unhappy with how we handle it you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.
Changes
If we change this notice we will update the date at the top. If the change is significant we will say so on the site.