Privacy notice

Updated September 22, 2026

Lockstep checks PostgreSQL migration SQL for patterns associated with heavy locks and table rewrites. This notice describes the information handled by the hosted checker and paid CI service.

SQL you submit

The free checker and paid CI endpoint receive SQL you choose to submit and analyze it for that request. Lockstep does not write submitted SQL to its application storage or include SQL bodies in application logs. Requests are handled by Cloudflare Workers; see Cloudflare's Privacy Policy. Do not submit credentials or SQL your organization does not allow you to share with a hosted service.

Subscription and CI access

Stripe processes checkout and payment details under Stripe's Privacy Policy. Lockstep uses the returned checkout session to verify the selected Lockstep plan. When you activate a CI key, Lockstep records the subscribed GitHub repository or organization in the Stripe subscription's metadata. The signed CI key is shown in your browser so you can copy it to your CI secret store.

On each paid CI request, Lockstep checks the key's subscription status with Stripe and analyzes the submitted SQL. It does not retain the key or SQL in an application database.

Browser storage and logs

The public checker does not require an account or use analytics cookies. During checkout activation, the browser temporarily holds the Stripe session identifier in session storage. After activation, it stores the issued CI key and its GitHub scope in local storage, where they remain available across tabs and browser restarts. Treat the key like a password: anyone using your unlocked browser profile may be able to access it. Use “Forget this browser’s key” in Lockstep or clear this site's browser storage to remove the local copy. Cloudflare may process request and runtime metadata to host the site; its privacy policy explains that processing.

Questions and requests

For information held directly by Stripe or Vercel, contact those providers through their respective privacy notices.