Privacy Policy

What We Collect

We collect the following categories of personal information:

Account Information. When you create an account, we collect your name, email address, and authentication credentials. If you sign in via a third-party provider (e.g., Google, GitHub), we receive basic profile information from that provider.

Payment Information. If you subscribe to a paid plan, our payment processor (Stripe) collects your payment card details. We do not store full card numbers on our servers — we only retain the card type, last four digits, and billing details necessary for invoicing.

Usage Data. We automatically collect information about how you interact with the Services, including IP address, browser type, device information, pages visited, and features used.

Project and Work Data. Quartermaster stores data you and your team create through the Services, including project names, tasks, commit messages, status updates, and context items (notes, links, and uploaded files). Data sent via MCP tool calls from your IDE is treated the same as data entered through the web application.

Cookies. We use essential cookies to keep you signed in and functional cookies to remember your preferences. We do not use advertising or behavioral tracking cookies.

How We Use Your Information

We use your personal information to:

• Provide, maintain, and improve the Services
• Process transactions and send related billing information
• Send transactional emails (account confirmation, password resets, billing notices)
• Respond to your requests, comments, or questions
• Monitor and analyze usage trends to improve the product
• Detect, prevent, and address technical issues or abuse
• Comply with legal obligations

We do not sell your personal information. We do not use your project data or work content to train machine learning models.

How We Share Your Information

We share your personal information only in the following circumstances:

Service Providers. We use third-party services to help operate our business, including hosting (Cloudflare, Vercel), database infrastructure (Neon), payment processing (Stripe), and analytics. These providers access your data only to perform services on our behalf and are obligated to protect it.

Your Team. Project data, tasks, updates, and context are visible to other members of your organization within Quartermaster. This is core to how the product works.

Legal Requirements. We may disclose your information if required by law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of Tortuga Labs, our users, or the public.

Business Transfers. If Tortuga Labs is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you before your information becomes subject to a different privacy policy.

Data Security

We implement appropriate technical and organizational measures to protect your personal information, including encryption in transit (TLS) and at rest. However, no method of transmission or storage is 100% secure. You are responsible for keeping your account credentials secure.

Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Services. If you delete your account, we will delete or anonymize your personal information within 30 days, except where we are required to retain it for legal or compliance purposes.

Children’s Privacy

Quartermaster is not intended for use by anyone under the age of 13. We do not knowingly collect personal information from children under 13. If we learn we have collected such information, we will delete it promptly. If you believe a child under 13 has provided us personal information, please contact us at support@bytortuga.com.

Your Rights

Depending on your location, you may have certain rights regarding your personal information:

Access and Portability. You can request a copy of the personal information we hold about you.

Correction. You can request that we correct inaccurate or incomplete personal information.

Deletion. You can request that we delete your personal information, subject to certain legal exceptions.

Opt-Out. You can opt out of marketing emails at any time by using the unsubscribe link in those emails.

California Residents. Under the California Consumer Privacy Act (CCPA), you have the right to know what personal information we collect, request its deletion, and opt out of its sale. We do not sell personal information.

European Residents. If you are in the EU/EEA, you have rights under the GDPR including access, rectification, erasure, restriction of processing, data portability, and the right to object. Our lawful bases for processing are contractual necessity (to provide the Services) and legitimate interest (to improve and secure the Services). You may lodge a complaint with your local data protection authority.

To exercise any of these rights, contact us at support@bytortuga.com.

International Data Transfers

Quartermaster is hosted in the United States. If you use the Services from outside the U.S., your information will be transferred to and processed in the U.S., where data protection laws may differ from your jurisdiction. By using the Services, you consent to this transfer.

Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or by posting a notice on the Services. Your continued use of Quartermaster after any changes constitutes acceptance of the updated policy.

Contact Us

If you have questions about this Privacy Policy, please contact us at:

Email: support@bytortuga.com
Address:
Tortuga Labs, LLC
1111B S Governors Ave
STE 37456
Dover, DE 19904