Hoistdeck privacy policy
Effective 2026-10-18 · applies to the Hoistdeck extension for VS Code and compatible editors, version 0.1.0 and later · publisher: Gilad Amar ("we")
1. Data the extension handles on your device
| Data | Where it is kept | How long |
|---|---|---|
| Server profiles: host, port, user name, remote path, key file path, ignore and protect patterns, options | .vscode/hoistdeck.json in your workspace (a file you control). Passwords are rejected in this file | Until you edit or delete the file |
| Passwords and private-key passphrases | VS Code SecretStorage, which uses the OS keychain: macOS Keychain, Windows Credential Manager, or libsecret on Linux | Until you run "Forget Stored Password", the server rejects it (it is then forgotten), or you uninstall |
Known host keys: for each host:port, the SHA-256 fingerprint of the server's SSH host key you accepted | VS Code global extension state on your computer | Until you uninstall |
| Per-workspace state: the active profile, the size and modification time of remote files last seen (for conflict detection) and a record of the last sync (for roll back) | VS Code workspace extension state | Until you uninstall or remove the workspace |
| License details if you activate Pro: plan, activation ID, purchase email and expiry returned by Lemon Squeezy, last check time. The key itself is kept in SecretStorage | VS Code global state + SecretStorage | Until you deactivate the license or uninstall |
| Backups of your server files: the previous version of each file Hoistdeck overwrites or deletes there (Free: the latest previous version per file; Pro: also a timestamped history of the last 20 uploads or syncs) | On your own server, in .hoistdeck-backup/ inside the profile's remote folder. Never on your computer or anywhere else | Free: until the next overwrite of that file replaces it; Pro: the 20 most recent batches. Until you delete the folder, or set "backups": false |
| Private key files | Read from the path you configure, only to connect. Never copied or uploaded | Not stored by Hoistdeck |
2. Data that leaves your device
Your files go only to your own servers. Hoistdeck connects only to the hosts listed in your hoistdeck.json, over SFTP (SSH), FTPS or FTP, using the credentials you provided. It uploads, downloads, lists or compares the files you ask it to, or that you save with upload on save turned on. Backups are on by default (free and Pro): the previous server copy of a file is moved, on that same server, into .hoistdeck-backup/. "Restore Previous Version" downloads that copy temporarily on your computer and uploads it back. Backups are never sent anywhere else. Plain FTP is unencrypted; prefer SFTP or FTPS. The servers you connect to, and their hosting providers, handle that data under their own terms.
Host keys. On first connection to an SFTP server, Hoistdeck shows the server's host-key fingerprint and remembers it once you accept. If the key later changes, it stops before sending your password or files and asks you. Fingerprints are stored only on your computer.
License checks. If you enter a Pro license key, the extension sends HTTPS requests to https://api.lemonsqueezy.com/v1/licenses/: activate (your key and a random instance name), validate (your key and the activation ID, at most once every 7 days) and deactivate. Lemon Squeezy (Merchant of Record) receives your IP address as with any web request and processes this data under its privacy policy.
Nothing is sent to us. Hoistdeck has no telemetry or analytics, and does not use VS Code's telemetry API.
3. Workspace trust
Hoistdeck does not run in untrusted (Restricted Mode) workspaces, because a workspace's config decides where files are sent.
4. Your choices and rights
Run "Forget Stored Password" for a profile, delete hoistdeck.json, remove backups from your server's .hoistdeck-backup/ folder, deactivate your license, or uninstall Hoistdeck (VS Code removes its extension state; remove keychain entries named after Hoistdeck if your OS keeps them). We hold no extension data on our servers. For purchase records held by Lemon Squeezy or any privacy question (including GDPR/UK GDPR requests), email busywright@mail.grokbot.com.
5. Children
Hoistdeck is a developer tool and is not directed at children under 16.
6. Changes
If a future version handles data differently, we will update this page and the effective date before releasing it.
7. Contact
Gilad Amar, Thailand · busywright@mail.grokbot.com