Privacy Policy

This policy explains what Deep Variance collects when you use deepvariance.com, Warden or Harvey, why we collect it, who else handles it, and how to have it deleted.

Who we are

Deep Variance Inc., a Delaware corporation at 447 Sutter St, Suite 506-1420, San Francisco, CA 94108, USA, runs deepvariance.com, provides Warden and Harvey, and is the controller of the personal data described here. When this policy says "we" or "us", that is who it means. Questions about this policy or your data: founders@deepvariance.com, or by post to the address above.

The short version

• The website sets no cookies that track you, and loads no Google Analytics, until you accept analytics in the cookie banner. Cookieless visit counts from Cloudflare run for everyone.
• We do not sell personal data, share it for advertising, or use it to train AI models.
• Warden keeps its full history on your own machine. What passes through our servers is described plainly below, including what is not yet end-to-end encrypted.
• Harvey engagements are governed by a written agreement with each customer, and Harvey never reads training data, checkpoints or model weights.

When you visit deepvariance.com

Cloudflare hosts and delivers this site (Cloudflare Workers), and processes the technical data every web request carries, such as your IP address, browser type and the page requested, in order to serve the site and protect it from abuse.

We use Cloudflare Web Analytics to count visits and page views. It sets no cookies, stores nothing on your device, and does not track you across sites. It records aggregate figures such as the page visited, the referring site, the country, the browser type and page load performance.

If you accept analytics, we also use Google Analytics to measure aggregated usage: which pages are visited, how visitors arrive, the type of device, and the approximate region. IP anonymisation is on and advertising features are off. If you reject, nothing is loaded and no analytics cookie is set. The Cookie Policy lists every cookie and storage item by name.

When you email us

If you write to us, ask for early access, subscribe to the newsletter or ask about a pilot, we keep your message, your email address and anything you choose to tell us, and use them to reply and to run the conversation or engagement. We only send newsletters to people who asked for them, and every newsletter carries our postal address and tells you how to stop.

Warden: your account

A Warden account needs an email address and a password. Supabase stores the account and sends the confirmation and password reset emails; we never store your password ourselves. To protect sign-in from abuse, we keep recent sign-in attempts, keyed by IP address and by email address, for rate limiting, and remove them within 60 days.

Paid plans are billed by Stripe. Stripe collects your card and billing details directly; we receive and keep only the identifiers and status of your subscription (for example, whether it is in trial, active or cancelled, and when the period ends).

Warden: your machines and your agents

Warden's daemon runs on your own computer and only accepts connections from that computer. It records what your AI coding agents do (sessions, commands, files touched, tool inputs, and the decisions made) in a local database on that machine. By default, finished sessions older than 30 days are pruned from that database. Uninstalling Warden keeps this local history unless you choose to purge it.

When you link a machine to your account, we store a random identifier for it, its hostname, and when it was linked and last seen. When you watch or answer from the browser or another device, the requests travel through our relay, which runs on Cloudflare. They carry what you need to decide: the command or tool call and its arguments, file paths, the working directory, workspace names and session titles (which can repeat the prompt you gave the agent). This content is encrypted in transit but is not yet end-to-end encrypted, so it is readable by the relay while it passes through. The relay does not write it to storage. Our hosting provider's operational logs may record request metadata such as URLs, which can include a machine's hostname.

If you never link a device, none of this leaves your machine: Warden watches and enforces on its own.

Some Warden features read usage from the AI tools you already use, such as Claude or Cursor, using credentials already on your machine. Those requests go directly from your machine to that provider, never through us.

Harvey

Harvey verifies the GPU capacity a customer has bought or financed. Each engagement is governed by a written engagement letter or statement of work, which controls where it differs from this policy, except where data protection law gives you rights that cannot be changed by agreement. Harvey's collectors are read-only and write only to a local directory in the customer's environment, which the customer can inspect before anything leaves. They collect hardware and configuration identifiers, performance telemetry, benchmark and job timings, and system logs. Hostnames and IP addresses are tokenised when the evidence bundle is assembled, text is scanned for secrets, and Harvey never reads training data, checkpoints or model weights.

Harvey data is mostly about machines, not people. Business contact details of the people we work with are handled like any other correspondence. Where an engagement letter permits it, we keep normalised performance ratios, never raw traces, to compare clusters across engagements, and a customer can withdraw that permission for their engagement.

Why we use personal data

• To provide the website, Warden and Harvey, and to operate your account and subscription (performance of a contract).
• To keep the services secure, prevent abuse and fix problems (our legitimate interests).
• To measure how the website is used, only with your consent, which you can withdraw at any time.
• To reply to you and keep records we are required to keep, such as billing records (legitimate interests and legal obligations).
• To send the newsletter, only if you asked for it (consent, which you can withdraw with the link in every email).
• To keep a minimal record of deleted accounts so billing cannot restart (our legitimate interest in accurate billing).
• We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

Who else handles it

We use a small number of service providers, each only for the service they provide to us:

Where data is processed

Deep Variance is based in the United States and our providers may process data in the United States and other countries. Where the law requires a safeguard for data transferred out of the EU, UK or Switzerland, we and our providers use the EU standard contractual clauses (with the UK addendum) or the provider’s certification under the EU-US Data Privacy Framework.

How long we keep it

• Email correspondence: for as long as the conversation or relationship is active, and then only as long as we reasonably need it.
• Hosting and security logs: rotated every 60 days.
• Sign-in attempt records: removed within 60 days.
• Warden account and machine records: until you revoke the machine or delete your account, and deleted immediately when you do.
• Billing records: as long as tax and accounting law requires. Stripe keeps its own records under Stripe's policies.
• Harvey engagement data: as set out in the engagement letter. Evidence behind an issued report is kept for the period that report can be relied on.
• Google Analytics data: under the data retention setting of our Google Analytics property.
• Cloudflare Web Analytics: aggregate figures with no identifiers, kept under Cloudflare’s retention for Web Analytics.

Deleting your Warden account

Deleting your account from Warden's settings takes effect immediately: it cancels any subscription, deletes your sign-in account, and erases your machine links and billing status from our relay. The only thing we keep is a marker that the account was deleted, with no email address, so that a late billing event cannot restart a subscription. Stripe keeps the billing records that tax law requires under its own policies, and the local history on your machines stays there until you remove it. If you cannot reach the delete control, email us and we will do it for you.

Your rights

You can ask for a copy of the personal data we hold about you, ask us to correct it, delete it or restrict how we use it, object to how we use it, or ask for it in a portable form. Where we rely on consent, you can withdraw it at any time. Email founders@deepvariance.com and we will answer within 30 days. You may also complain to your local data protection authority.

California residents have the right to know, delete and correct personal information, and to be free from discrimination for exercising those rights. We do not sell or share personal information for cross-context behavioural advertising. We use account credentials only to sign you in and keep your account secure. To make a request, email us from the address on your account, or have an authorized agent contact us with your written permission; we may ask for information to verify your identity.

Browsers can send Do Not Track signals. The website does not respond to them, but it loads no Google Analytics unless you accept it in the cookie banner.

Children

Our services are for professionals and are not directed to children under 16. We do not knowingly collect their personal data.

Security

We protect data with measures suited to what it is, including encryption in transit, separate access credentials for each part of Warden, and a hash-chained local audit log that shows if a past record was changed. No system is perfectly secure, and the Warden limits above (such as the relay not yet being end-to-end encrypted) are stated so you can decide what to link.

Changes

When this policy changes, the date at the top changes. For a material change we will also say so on the site, and email Warden account holders, at least 30 days before it takes effect, unless the law requires a change sooner.

Questions about this page: founders@deepvariance.com