Fixed Point Labs

Privacy policy

Last updated: October 1, 2026

The privacy of your data—and it is your data, not ours!—is a big deal to us. In this policy, we lay out: what data we collect and why; how your data is handled; and your rights with respect to your data. We promise we never sell your data: never have, never will.

This policy is split into sections. For your convenience, links to each of those sections is as follows:

This policy applies to all products built and maintained by Fixed Point Labs LLC, including our flagship product, Rift.

This policy applies to our handling of information about site visitors, prospective customers, and customers and authorized users (in relation to their procurement of the services and management of their relationship with Fixed Point Labs). We refer collectively to these categories of individuals as "you" throughout this policy.

Customers sometimes put other people’s personal information in Rift, for example in a VM or a repository. We process that information for the customer and only as the customer directs. The customer is responsible for it, and questions about it should go to the customer.

What we collect and why

Our guiding principle is to collect only what we need. Here’s what that means in practice:

Identity and access

When you sign up for a Fixed Point Labs product, we ask for identifying information such as your name, email address, and maybe a company name. That’s so you can personalize your new account, and we can send you product updates and other essential information. We may also send you optional surveys from time to time to help us understand how you use our products and to make improvements. With your consent, we will send you our newsletter and other updates.

We’ll never sell your personal information to third parties, and we won’t use your name or company in marketing statements without your permission either.

Billing information

If you sign up for a paid Fixed Point Labs product, you will be asked to provide your payment information and billing address. Credit card information is submitted directly to our payment processor and doesn’t hit Fixed Point Labs servers. We store a record of the payment transaction, including the last 4 digits of the credit card number, for purposes of account history, invoicing, and billing support. We store your billing address so we can charge you for service, calculate any sales tax due, send you invoices, and detect fraudulent credit card transactions. We occasionally use aggregate billing information to guide our marketing efforts.

Product interactions

We store on our servers the content that you upload or receive or maintain in your Fixed Point Labs product accounts. This is so you can use our products as intended, for example, to list VMs you've launched on Rift. We keep this content as long as your account is active. If you delete your account, we’ll delete the content within 60 days.

Git forge connections

Rift works with your code through git forges, such as GitHub. When you connect a git forge account, we receive and store the information we need to act for you: your account name and identifier on the forge, and access tokens, which we store encrypted. A connected forge also sends us notifications, for example when access to a repository changes or when someone pushes to a branch. From these we keep only what Rift needs to stay in sync: which repositories we can reach, who installed our access, and the branch and commit of each push. We use this information only to keep Rift in sync with your repositories, to clone repositories into your VMs, and to push changes and open pull requests when you or your agents ask. Each git forge that Rift connects to is one of our subprocessors, and we add a forge to our subprocessor list before we offer connections to it. You can revoke our access at any time from your account settings on the forge.

Platform activity

We record how your VMs use resources, such as CPU time, memory, storage, and the volume of network traffic, so that we can bill you for metered usage and keep the platform stable. We may also use automated tools to check this activity, and the network connections that your VMs make, to detect uses that our Use Restrictions policy does not allow, such as cryptocurrency mining or network scanning. These checks look at activity metadata, not at the content of your files or network traffic.

IP addresses

We may record the IP address you use to sign up and to sign in. We use it to detect and prevent fraud, abuse, and spam sign-ups, and to keep your account secure. We keep it for as long as your account is active.

Website and platform usage

We collect information about how you use our websites and Services, such as your IP address, the pages you visit, how long they take to load, and when and how much you use Rift. We use this information to:

We look at this information in aggregate. We do not use advertising or third-party analytics cookies.

Anti-bot assessments

We use fraud and abuse detection tools across our applications to mitigate brute force logins and as a means of spam protection. We have a legitimate interest in protecting our apps and the broader Internet community from credential stuffing attacks and spam. When you fill in certain forms, these tools evaluate various information (e.g., your IP address) to try to detect if the activity is from an automated program instead of a human. These tools then provide Fixed Point Labs with the spam score results.

Cookies

We use one first-party session cookie to keep you signed in. We do not use advertising or third-party cookies. If you block cookies in your browser, you will not be able to sign in.

Voluntary correspondence

When you email Fixed Point Labs with a question or to ask for help, we keep that correspondence, including your email address, so that we have a history of past correspondence to reference if you reach out in the future.

When you send us feedback through Rift, we store that feedback and send it to Linear, one of our subprocessors.

We also store information you may volunteer, for example, written responses to surveys. If you agree to a customer interview, we may ask for your permission to record the conversation for future reference or use. We will only do so with your express consent.

When we access or disclose your information

To provide products or services you’ve requested. We use third-party subprocessors to help run Rift and provide the Services to you. They are listed under Subprocessors.

No Fixed Point Labs human looks at your content except in a few limited cases: to fix an error that stops an automated process and needs manual intervention, to help with a support request when you give us permission, to investigate restricted uses, and when the law requires it. Errors that need manual intervention are rare, and when they happen, we look for root-cause fixes so that they do not recur.

To help you troubleshoot or squash a software bug, with your permission. If at any point we need to access your content to help you with a support case, we will ask for your consent before proceeding.

To investigate, prevent, or take action regarding restricted uses. Accessing a customer’s account when investigating potential abuse is a measure of last resort. We want to protect the privacy and safety of both our customers and the people reporting issues to us, and we do our best to balance those responsibilities throughout the process. If we discover you are using our products for a restricted purpose, we will take action as necessary, including notifying appropriate authorities where warranted.

We do not train AI models on your content. We do not use your content, including the code and data in your VMs and repositories, to train artificial intelligence models, and we do not give it to others for that purpose.

Aggregated and de-identified data. We may aggregate and/or de-identify information collected through the services. We may use de-identified or aggregated data for any purpose, including marketing or analytics.

When required under applicable law. We disclose your information to government authorities only when the law requires it, for example in response to a valid subpoena, court order, or warrant, or in an emergency that involves a risk of death or serious injury. Where the law allows, we will tell you before we disclose your information. If a tax authority audits us, we disclose only the minimum billing information needed.

Finally, if Fixed Point Labs is acquired by or merges with another company, your information may transfer to the new owner. The new owner must follow this policy, or tell you about changes to it before they apply to your information.

Your rights with respect to your information

You can ask us to access, correct, export, or delete your personal information, or object to how we use it, by emailing support@fixedlabs.dev. We honor these requests for everyone, wherever you live, except where we must keep information by law or to provide the Services to you. Some requests, such as deletion, may mean that we have to close your account.

Some decisions are automatic. For example, our anti-bot tools can refuse a sign-up. If you think an automatic decision about you is wrong, email us and a person will review it.

In some cases, we also need to take reasonable steps to verify your identity before responding to a request, which may include, at a minimum, depending on the sensitivity of the information you are requesting and the type of request you are making, verifying your name and email address. If we are unable to verify you, we may be unable to respond to your requests. If you have questions about exercising these rights or need assistance, please contact us at support@fixedlabs.dev. If an authorized agent is corresponding on your behalf, we will need written consent with a signature from the account holder before proceeding.

Depending on applicable law, you may have the right to appeal our decision to deny your request, if applicable. We will provide information about how to exercise that right in our response denying the request. You also have the right to lodge a complaint with a supervisory authority. If you are in the EU or UK, you can contact your data protection authority to file a complaint or learn more about local privacy laws.

How we secure your data

All data is encrypted via SSL/TLS when transmitted from our servers to your browser.

What happens when you delete VMs or close your account

When you destroy a VM or delete a snapshot, the VM's disk and snapshots are no longer accessible through Rift. We delete them from our systems within 7 days.

If you choose to cancel your account, your content will become immediately inaccessible and should be purged from our systems in full within 60 days. This applies both for cases when an account owner directly cancels and for auto-canceled accounts. Please refer to our Cancellation policy for more details.

Data retention

We keep your information for the time necessary for the purposes for which it is processed. The length of time for which we retain information depends on the purposes for which we collected and use it and your choices, after which time we may delete and/or aggregate it. We may also retain and use this information as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements. Through this policy, we have provided specific retention periods for certain types of information.

Location of site and data

Fixed Point Labs is based in the United States. If you are located outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States and in other countries where our subprocessors operate. By using our websites or Services and/or providing us with your personal information, you consent to this transfer.

Children

Rift is not for anyone under 18, and we do not knowingly collect personal information from children. If you believe that a child has given us personal information, email us at support@fixedlabs.dev and we will delete it.

Subprocessors

These companies process personal information for us to help us provide the Services:

We update this list before we start to use a new subprocessor.

Changes and questions

We may update this policy as needed to comply with relevant regulations and reflect any new practices. Whenever we make a significant change to our policies, we will refresh the date at the top of this page and take any other appropriate steps to notify users.

Have any questions, comments, or concerns about this privacy policy, your data, or your rights with respect to your information? Please get in touch by emailing us at support@fixedlabs.dev and we’ll be happy to try to answer them!

Adapted from the Basecamp open-source policies, licensed under CC BY 4.0. Our deepest gratitude to Basecamp for publishing their policies under an open license.