+decoy.x7k2q@decoyprobe.dev
private note x7k2q
It signs up with a throwaway test account
Your pipeline signs up to your app with details made fresh for this check, then uses it like a person would. No real user is involved.
Reading today's check
See Where Your Users' Data Really Goes
Every day Decoy signs up to your app with a throwaway test account, follows every detail that leaves it, and shows your users who got it. If a privacy promise breaks, GitLab Duo fixes it for you.
+today's decoy
Today's test account on Jotter, and where its details went.
How it works
Three steps, every day
Decoy runs on its own after you set it up. Scroll to follow one check from start to finish.
posthog.compage view
anthropic.comyour note
facebook.comyour email, hashed
It follows every detail that leaves
Every request from the browser and your servers is recorded. The test details exist nowhere else, so each one found is proof of where it went.
Every promise kept
Leak fixed by GitLab Duo
It tells your users and fixes what breaks
Your users get a public page showing who got their data. If a promise breaks, GitLab Duo writes the fix and it merges once checks pass.
Live example
See it working on a real app
Jotter is a notes app that runs Decoy every day. Walk through what that looks like in four steps.
jotter-notebook.vercel.app
Every day the test account signs up here, writes a note and asks for a summary.Open Jotter
emailWe never share your email with advertisers, analytics companies or AI providers.nobody outside
nameWe never share your name with advertisers, analytics companies or AI providers.nobody outside
phoneWe never share your phone number with advertisers, analytics companies or AI providers.nobody outside
noteA note only leaves Jotter when you press Summarise, and only to our AI provider, Anthropic.Anthropic only
Written once in plain words. Decoy checks every one of them, every day.Read Jotter's privacy page
status page
Jotter links to this page from its own footer, so its users can check it any time.Open the status page
Reading the latest incident from GitLab
Every step above is a real event in the GitLab project.See all incidents
Set it up
Write your promises. Decoy keeps you to them
Answer two questions about your app. You get your promises in plain words, the file Decoy checks against, and how to switch it on.
The page where people sign up.
Tick each detail, then choose who may receive it.
Your promises, in plain words
decoy.rules.yml
3. Switch it on
- Add the file above to your GitLab project, plus a short journey file that says where your sign up form is.
- Add the privacy check job and a daily pipeline schedule.
- Turn on the Decoy responder flow in GitLab Duo, so broken promises get fixed. Full setup guide
Why it matters
Broken privacy promises are expensive
$7.8M
BetterHelp
Paid after users' email addresses and therapy history were used for Facebook ad targeting.
FTC order, 2023$1.5M
GoodRx
Penalty for sending people's health data to Facebook and Google without telling them.
FTC action, 2023Pixel
US hospitals
Appointment details sent to Meta by a tracking pixel on the hospitals' own websites.
The Markup, 2022None of these were hacks. They were ordinary changes nobody checked against the promise
FAQ
Questions people ask first
Does Decoy ever touch real users' data?
No. It only follows its own test account, made up fresh for each check. It never reads your users' traffic, logs or database, and your users are never asked to do anything.
What if a tool scrambles the email first?
Decoy also looks for encoded, compressed and hashed copies, the way ad pixels send them. A hashed email is still your email.
How do I know it really works?
Leaks are planted on purpose and the real check runs against each one. It caught every planted leak with no false alarms, and the few it cannot see are written down in the answer key.
What does GitLab Duo actually do?
When the daily check fails, a GitLab Duo flow reads what broke, finds the cause, opens an incident, writes the smallest honest fix, checks it with the same test account and opens a merge request. The fix merges once every check passes.
Can it change my promises to make a check pass?
No. It is told never to weaken a promise, the privacy page or a test, and only fixes that close an incident are merged.
Is this legal advice?
No. Decoy reports where data went against the promises you wrote. Whether something is lawful is a question for a lawyer.
Does it work on mobile apps?
Not yet. It checks web apps: everything the browser sends and every outside call from a Node server.