At a glance
You can read the website and download GateRook without an account. Google Analytics is enabled by default unless you choose not to share analytics. You can turn it off at any time in Analytics settings. The website also uses hosting services and checks GitHub for the latest release.
The desktop application stores its configuration and activity locally. Connecting an AI client, service, tunnel or export destination can send data to that provider. Local operation does not mean that all data stays on your device.
1. Who is responsible
GateRook and this website at msrv.dev are operated by Vadym Dobroskok, based in Spain. In this policy, “we” and “us” refer to this operator. For the website and correspondence described below, Vadym Dobroskok is the data controller.
Contact us at vd@msrv.dev for privacy questions or requests. Please do not send passwords, access tokens, private keys or unredacted production data.
This policy covers the website and explains the desktop application's data flows. When you or your organisation use GateRook to process someone else's data, you control that processing and must have the necessary permission and legal basis. Installing GateRook does not give us access to your local database or make us the host of your connected data.
2. Data used by the website
Delivering and protecting the site. Our hosting and delivery providers process network information such as IP addresses, request times, requested URLs, response status and browser information. Access and error logs help deliver pages, investigate faults and prevent abuse. This processing serves our legitimate interests in operating a reliable, secure website.
Checking releases and downloading. When the site opens with JavaScript enabled, your browser requests the latest public release from GitHub. Opening the download dialog can refresh that check. These requests do not include a GitHub login, access token or referring page, but GitHub receives the IP address and request headers needed to respond. Installers and release notes are also hosted on GitHub. We use this functionality in our legitimate interest in providing current, working downloads; it is separate from optional analytics.
Optional analytics. Google Analytics is enabled by default unless you have declined it. While enabled, it receives page views, page titles, cookie identifiers and information about your browser, device, session and approximate location. Google processes network information to provide the service. We send only known public page URLs, without query strings or fragments, and reduce the initial referring URL to its website origin. We do not send search text, demo comments or connected infrastructure data to website analytics. Advertising features and Google signals are disabled.
Messages and public contributions. If you email us, we process your email address, message and any information you choose to include to respond and resolve your request. This is based on our legitimate interest in providing support, or a legal obligation when handling a data-rights request. GitHub issues and contributions are public: their author details and content are visible to others under GitHub's policies. Use email for private matters.
We do not sell personal data or use the website's data for personalised advertising. We do not use it to make automated decisions that produce legal or similarly significant effects about you. Providing a support message is optional, and you can disable analytics without losing access to the website or downloads; essential network processing is needed to serve the website.
4. Data in the desktop application
GateRook is a local gateway between your AI clients and the services you configure. Your installation stores connection settings, credentials, access rules, approvals and activity records on your computer. Stored secret values are encrypted; this does not mean that every configuration file, activity record, log or backup is encrypted.
Activity may include client identities, timestamps, tool arguments, decisions and result previews. Masking and output limits help reduce exposure, but records and results can still contain personal or confidential information. The application does not send tool-call contents or local activity to GateRook for product analytics by default.
When you authorise a call, the configured service receives the request and any credentials needed for authentication. Results are returned to the connected AI client. Its provider may process and retain that information under its own terms. Optional tunnels, remote MCP servers, plugins, secret stores, notifications and audit exports can introduce other recipients. Review the providers you enable and the permissions you grant.
Supported installed builds check GitHub for updates automatically by default. You can disable automatic checks in the application's settings. Update requests expose ordinary network information to the update provider; they do not upload your local activity database.
You control local files, backups, exports and connected-service retention. The current default activity retention is one year and can be changed in settings; pending exports can delay deletion. Automatic daily database backups are enabled by default and retain seven copies. Removing the application does not necessarily remove its data or copies you have exported. Review those copies separately when deleting data.
5. Providers and international processing
Website hosting, delivery, security, analytics and email providers process information needed for their services. Relevant public policies include Google (opens in a new tab) and GitHub (opens in a new tab). Providers may process data outside Spain and the European Economic Area, including in the United States.
Google's data processing terms (opens in a new tab) describe its international-transfer safeguards, including the European Commission's Standard Contractual Clauses for transfers that require them. GitHub's privacy statement describes its use of those clauses and the EU–US Data Privacy Framework. These documents explain the providers' arrangements and make the safeguards available to read. You may also contact us for information relevant to your data. The providers you independently connect to the desktop application are governed by your arrangements with them.
We may also disclose information where required by law or where necessary to investigate abuse or establish, exercise or defend legal claims. We limit any such disclosure to the information needed for that purpose.
6. How long data is kept
Browser preferences last as described above. For operational logs and correspondence, retention depends on the time needed to diagnose a fault, investigate abuse, resolve a request and meet applicable legal obligations or resolve a dispute. Records relevant to an unresolved issue may need to be kept longer than routine records.
Our Google Analytics property is configured to retain event data for 2 months and user data for 14 months. The user-data retention period resets when a visitor has new activity while analytics is enabled. Google applies these controls to user and event data; aggregated reports may remain available longer. Cookie lifetime is separate from report retention. See Google's retention explanation (opens in a new tab). Third-party services and your own backups have their own retention rules.
7. Your data protection rights
Where the GDPR applies, you may request access, correction, erasure, restriction and, where applicable, portability of your personal data. You may object to processing based on legitimate interests and withdraw consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.
Email vd@msrv.dev with your request. We may ask for information reasonably needed to verify your identity or locate the records, and normally respond within one month. If a lawful extension is needed, we will explain it within that period. We cannot access or delete files held only on your device or in services you control.
You may complain to the Spanish Data Protection Agency (AEPD) (opens in a new tab) or the competent supervisory authority where you live, work or believe an infringement occurred.
8. Changes to this policy
We will update this page and its date when our practices change. If a new use of data requires consent, we will request it before starting that use. GateRook is a developer tool and is not directed at children; contact us if you believe a child has sent us personal data.
See also the Terms of Use and the guide to GateRook's request flow.