Privacy Policy

1. Who we are

Seamark Registry LLC, 5900 Balcones Dr, Ste 100, Austin, TX 78731, United States, is responsible for the personal data described in this policy (the "controller" under EU and UK data protection law). You can reach us at privacy@seamark.dev.

2. Where your data lives

Seamark keeps data in three kinds of places:

• Your PDS. Your AT Protocol account lives on a Personal Data Server (PDS) run by you or a provider you chose. When you use Seamark, we write records under the io.atcr.* namespace to your repository there: image manifests, tags, your Seamark settings, stars and repository pages. Anyone can read them, and your PDS provider's policies govern how they are stored. We can change them only while you allow Seamark access to your account.
• Our AppView. seamark.dev and the registry domains run on our servers. They keep a copy of public records for search and display, plus the account data described below.
• Holds. A hold is a storage server for image layers. We operate the hold at us-chi1.cove.seamark.dev. You can instead choose a hold run by someone else, including one you run yourself. That hold's operator is responsible for the data it stores, and this policy doesn't cover it.

3. What we collect and why

3.1 Public records we index

We index public io.atcr.* records from every AT Protocol account that publishes them, whether or not the account has signed in to Seamark, along with the handle and avatar from the account's public profile. We use them for search, repository pages and routing pulls. Our copy follows your PDS through the network's event stream: when you delete a record there, we delete our copy. We also re-read public records once a day, so records that remain on your PDS reappear on Seamark even after you delete your Seamark data (see section 8).

3.2 Your account

Your DID, handle, PDS address, default hold, Seamark preferences (such as automatic removal of untagged images and your preferred registry domain), and when you last signed in or pushed. We use this to run your account and keep it until you delete your Seamark data.

3.3 Signing in

• Website and OAuth. When you sign in, your PDS gives us OAuth tokens that let us act for you within the permissions you approved: writing io.atcr.* records to your repository, uploading image manifests, and getting short-lived tokens to access holds for you. We never see your account password. A cookie keeps your browser signed in until you sign out or the session expires. The OAuth session itself stays available to your other browsers and devices until 30 days after it was last used, or until you delete your Seamark data.
• Credential helper. When you approve the Seamark credential helper, we store the device name, the IP address and software version (user agent) it connected from, and when it was created and last used, so you can recognize and revoke it in Settings. We keep this until you revoke the device. The helper stores its own token on your computer.
• App passwords. If you run docker login with an app password instead of using the credential helper, we pass it to your PDS to create a session. We don't store the password, and the session is kept in memory for up to 2 hours.

3.4 Webhooks

If you create a webhook, we store its URL, secret and triggers, and send event details (such as the repository, tag, digest, pusher, vulnerability counts or storage usage) to that URL. We keep the webhook until you delete it or your Seamark data.

3.5 Our holds

Image data. Image layers and configuration are stored in object storage by content digest. Identical layers pushed by different people are stored once and shared. We keep image data while any image uses it, and our nightly cleanup removes data that no image uses, normally within 30 days.

Hold records. Each hold is also an AT Protocol account with its own public repository. Our holds record:

• your membership: your DID, permissions, plan tier and founding-member status;
• each layer you push: its digest, size and type, the image it belongs to, and your DID;
• pull and push counts for each of your repositories, including daily counts;
• vulnerability scan results for your images, including a software bill of materials (SBOM);
• each image's configuration, which includes its environment variables, labels, entrypoint and build history.

Anyone can read these records, whatever a hold's access settings, and the hold announces them to public relays on the AT Protocol network, so copies can exist beyond our servers. Access settings such as invite-only registration control who can push to a hold; they don't make its data private. We use hold records to store and serve images, apply quotas, and show usage and security information.

3.6 Vulnerability scanning

Our scanner, which runs on our own server, reads your image layers to produce an SBOM and a vulnerability report after you push and again periodically. It receives the repository, tag, your DID and your handle. The results are published as hold records (section 3.5).

3.7 Subscriptions

If you subscribe to a paid plan, Stripe processes the payment and collects your email address, payment details and billing address under its own privacy policy. We never receive your full card number. We create your Stripe customer record with your handle and DID, and we can see your email and billing details in Stripe to manage your subscription and send you notices about it. We keep a record of the Stripe events we have processed, and billing records for as long as tax and accounting law requires. Your plan tier is part of your public membership record (section 3.5).

3.8 AI image advisor

When you use the AI image advisor on one of your images, information about that image, such as its name, manifest, configuration, layers, SBOM and vulnerability scan results, may be sent to Anthropic to generate suggestions. We store the suggestions for that image so they can be shown again without another request. The advisor runs only when you ask it to, it's available on some plans, and you can turn it off in Settings.

3.9 Logs

Our servers log each request with its IP address, the URL requested, the time and the response status. Application logs can also include your DID and handle, and which images signed-in users pull. Logs stay on our servers, only we can read them, and we keep them for up to 90 days. We use them to operate, secure and debug the Service.

3.10 Moderation

When we act on a legal complaint or a violation of our Terms of Service, our labeler publishes a takedown label for the account or repository. Labels are public. We keep takedown records for as long as they apply.

4. Cookies and browser storage

We use these cookies:

• atcr_session keeps you signed in.
• oauth_return_to remembers where to send you after you sign in.
• atcr_login_handle remembers the handle you signed in with, so the sign-in form can suggest it next time.

The site also uses your browser's local storage for recent handles, cached profile names and display preferences. We don't use advertising, analytics or other tracking cookies. Because we don't track you across sites, Do Not Track and Global Privacy Control signals don't change what we do.

Some pages load content from other services, which then receive your IP address: avatars and repository icons from imgs.blue; handle suggestions on the sign-in page from typeahead.waow.tech and public.api.bsky.app, which receive what you type in the handle field; and images that publishers embed in a README or repository icon, which can come from any site.

5. Who we share data with

Service providers that process data for us:

• UpCloud: servers, load balancing and object storage.
• Bunny: content delivery for our registry domains, object storage and database hosting.
• Fastmail: email.
• Stripe: payments, for subscribers.
• Anthropic: the AI image advisor, when you use it.

We also share data:

• with the AT Protocol network, where public records on your PDS and our holds are distributed by relays and can be read and copied by anyone;
• with the hold operators you choose, and with the webhook URLs you configure;
• when the law requires it, or to protect the rights and safety of Seamark, our users or others;
• with a buyer or successor if Seamark Registry LLC is sold, merged or reorganized.

We don't sell your personal data or share it for advertising.

6. Legal bases (EEA and UK)

• Contract: running your account, storing and serving your images, sign-in, subscriptions, webhooks, and features you choose to use, such as the AI advisor.
• Legitimate interests: indexing public AT Protocol records, including those of accounts that haven't signed in to Seamark; publishing vulnerability information; and keeping logs to secure and debug the Service.
• Legal obligation: billing records and responding to lawful requests.

7. How long we keep data

8. Exporting and deleting your data

Export. Settings › Export All My Data downloads a file with your devices, sign-in sessions (not the tokens), hold memberships, webhooks (without their secrets), vulnerability scan summaries, advisor suggestions, and the records our holds keep about you (membership, layers and usage counts). Your public records are in your repository on your PDS, where any AT Protocol tool can export them. For anything else, email privacy@seamark.dev.

Delete. Settings › Delete My Seamark Data does the following:

• On Seamark: deletes your account data, sessions, devices, webhooks, scan summaries, advisor suggestions and our copy of your public records.
• On your PDS: if you tick "Also delete all io.atcr.* records from my ATProto PDS", we delete them too. If you don't, they stay public on your PDS, and our daily re-indexing adds your repositories back to Seamark. Delete them from your PDS to keep them off Seamark.
• On our holds: we delete your membership, layer and usage records. Image data that no other image uses is removed by our nightly cleanup, normally within 30 days. Scan results, image configurations and daily usage counts stay on the hold (scan results and configurations are shared by everyone who pushed the same image). Records we delete remain in the hold's public history, which anyone can download, and relays may keep copies.
• On other holds: we ask them to delete your data, but we can't guarantee they do.
• Elsewhere: others on the AT Protocol network may have copied public records.

We keep billing records as the law requires, and Stripe keeps its records under its own policy. Deleting your Seamark data doesn't delete your AT Protocol account.

9. Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict how we use it, and to withdraw consent. We give these rights to everyone, wherever they live. Use the tools in section 8 or email privacy@seamark.dev. We'll confirm a request comes from you by checking that you control the account (DID), and we'll respond within 30 days. If we decline a request, you can appeal by replying to our answer. If you're in the EEA or UK, you can also complain to your data protection authority.

We don't sell personal information or share it for cross-context behavioral advertising, and we don't use sensitive personal information to infer characteristics about you.

10. Children

Seamark isn't intended for children under 13, and we don't knowingly collect their personal data. If you believe a child under 13 has used Seamark, email privacy@seamark.dev and we'll delete their data.

11. International transfers

We're based in the United States and our servers are in the United States. Some of our service providers process data in other countries. Public AT Protocol data is copied worldwide by design.

12. Security

We use HTTPS for all connections, store credential-helper secrets only as hashes, and never store passwords. Our OAuth access is limited to the permissions described in section 3.3. No system is perfectly secure, and we can't guarantee the security of your data.

13. Changes to this policy

We may update this policy. We'll post the new version here with a new date, and changes take effect when posted.

14. Contact

Seamark Registry LLC
5900 Balcones Dr, Ste 100
Austin, TX 78731
privacy@seamark.dev