Privacy

Last updated: 10 August 2026

The short version

RedLens has no server, and your data never reaches us. Your SQL, your query results, your schemas, your credentials and your AWS traffic go directly between your machine and your own systems. We do not proxy them, store them or receive them — there is no infrastructure of ours in that path to receive them with.

The only thing that can ever leave your machine is optional usage telemetry, which is off unless you turn it on, and which is described below in full.

What we never receive

• Your SQL. Queries, notebooks, saved queries and generated DDL stay local.
• Your results. Rows never leave the extension.
• Your schemas. Table, column, schema, user and role names are not transmitted.
• Your credentials. Passwords live in VS Code’s Secret Storage; AWS credentials come from your own credential chain. Neither is read by us.
• Your endpoints. Cluster and workgroup addresses stay in your settings.
• Error messages. A Redshift error routinely contains table names and sometimes values, so error reporting is switched off entirely rather than scrubbed. There is no scrubber good enough to make it safe.

Optional usage telemetry

Default: off. It is enabled only if you set redlens.telemetry.enabled to true, and VS Code’s own telemetry.telemetryLevel allows it. VS Code’s setting always wins: if telemetry is off there, RedLens sends nothing whatever its own setting says. Launching VS Code with --disable-telemetry also stops it.

When it is on, these are the only events, and this is the whole payload:

Event	What travels
install	that a first activation happened
activate	that the extension started
command	the id of a RedLens command that was run, from a fixed list
trial-started	that a trial began
licence-activated	that a licence verified, and the plan (pro, team or enterprise)

There is no free-text field anywhere in that payload. The design is an allowlist: the emitter refuses anything it was not told about in advance, so customer data cannot get in — not because we are careful with it, but because there is nowhere to put it.

No identifier travels with these events: no machine id, no email, no session id, no IP-derived identity of any kind. They are counts. We use them to answer one question — how many people who install RedLens go on to try and to buy — and nothing about who you are can be reconstructed from them.

Licence keys

Licence keys are verified offline, against a public key inside the extension. Activating a key does contact our issuing service once, to exchange the key you bought for a signed entitlement bound to your machine. That single request carries your licence key and a machine identifier and nothing else. After it, the entitlement is checked locally forever — if our service disappeared tomorrow, your licence would keep working.

Purchases are handled by Polar, our merchant of record, who processes your payment and holds your billing details under their own privacy policy. We receive the email address attached to a purchased licence so that the licence can be attributed to someone.

Third parties in the path

• Polar — payments and licence issuance.
• GitHub / Microsoft — the Marketplace you installed from, and this site.
• Your AWS account and your Copilot subscription — reached directly by your machine, under your own agreements with them. AI features use the language model you are signed in to; we neither provide nor proxy one.

Your rights and how to reach us

To ask what we hold, or to have it removed, write to support. Realistically, for most users the answer is that we hold nothing but the email attached to a purchase.

Changes

Material changes will be noted here with a new date. This page is versioned publicly so a change is visible rather than silent.