CCPA Self-Assessment with Evidence

Measure: Privacy Policy discloses all categories of personal information collected, purposes of collection, and categories of third parties with whom data is shared. Users can view their data through the Accounts dashboard.

Evidence: Privacy Policy at docs.sigmashake.com/policies/privacy-policy. Self-service dashboard at accounts.sigmashake.com.

Measure: Full account deletion cascade removes all personal information across 7 data stores in a single request. Deletion is immediate and covers: user record, sessions, rulesets, device bindings, payment data (via Stripe), OAuth tokens, and cookies.

Evidence: Self-service deletion available in Accounts dashboard under Settings. Also available via security@sigmashake.com.

Measure: User identity data is sourced from OAuth providers (GitHub, Google). Users correct their information at the identity provider, and SigmaShake refreshes on each login.

Evidence: OAuth profile sync on every authentication. No separate user data entry is maintained.

Measure: Categories collected: identifiers (username, email via OAuth), commercial information (subscription tier, billing via Stripe), internet activity (anonymized telemetry — opt-in only). No biometric data, no geolocation, no sensitive categories.

Evidence: Category inventory documented in Privacy Policy.

Measure: SigmaShake does not sell personal information. SigmaShake does not share personal information for cross-context behavioral advertising. Disclosure of service providers: Cloudflare, Stripe, GitHub, Anthropic, Resend.

Evidence: Privacy Policy explicitly states: "We do not sell your personal information." Service provider list maintained.

Measure: Not applicable — SigmaShake does not sell or share personal information for advertising. No "Do Not Sell My Personal Information" link is required, but non-sale status is documented in the Privacy Policy.

Evidence: Privacy Policy. No advertising SDKs, no tracking pixels, no data broker relationships.

Measure: All users who exercise their privacy rights receive the same service quality and pricing. No price discrimination, service degradation, or different treatment for privacy rights exercise.

Evidence: Uniform pricing published at sigmashake.com. No differentiated service tiers based on privacy elections.

Measure: Privacy requests accepted via: (1) Self-service Accounts dashboard for deletion, (2) Email to security@sigmashake.com for any CCPA request. Response within 45 days per statute.

Evidence: Contact methods listed in Privacy Policy footer. Self-service deletion in Accounts dashboard.

Measure: Not applicable — SigmaShake does not sell or share personal information. No opt-out link is legally required.

Evidence: No data sale or sharing activity exists to opt out of.

Measure: All subprocessors (Cloudflare, Stripe, GitHub, Anthropic, Resend) operate under agreements that restrict data use to contracted purposes only. No subprocessor receives data for independent use.

Evidence: Service provider agreements in place. Subprocessor list published in Privacy Policy and threat model.

Measure: SigmaShake implements reasonable security measures: encryption at rest and in transit, access controls, audit logging, incident response procedures, and 48-hour breach notification SLA.

Evidence: Security controls documented in Trust Center. Breach notification process defined in NDA §6 and responsible disclosure policy.

Measure: Only personal information reasonably necessary for each disclosed purpose is collected. Telemetry is anonymous and opt-in. OAuth uses minimum scopes. CLI processes metadata only, never source code.

Evidence: Telemetry schema: 7 fields, no PII. OAuth scopes: read:user, public_repo (read-only, no write).