Privacy and data handling
Early-access operational notice · Updated October 10, 2026. Deployment-specific operator identity and contact details must be supplied before public launch.
What is stored
Account email/name, Argon2 password hashes, workspace memberships, hashed sessions, repository metadata, bounded selected source and embeddings, pinned analyses, evidence, nonsecret provider preferences and audit events. Contact forms store name, email, topic and message.
External services
GitHub supplies authorized repository data. Google/GitHub verify social identity when configured. Your selected AI provider receives bounded source/question context only for approved operations. Provider API keys are not persisted. When team email notifications are enabled, Resend receives the contact name, email, topic and message to notify the operator. Do not include credentials or sensitive information in your message.
Retention and removal
Contact submissions expire after 90 days. Repository indexes and completed analyses expire according to repository policy, 1–90 days. OAuth state expires after 10 minutes; sessions after seven days. Cleanup requires the API worker to run. Database backups may retain deleted data under the deployment operator’s backup policy.
Your controls
Export current account/workspace analyses in account settings and delete a personal account with confirmation. Disconnect repositories and revoke installation access at GitHub. Request help through the contact form; automated email replies are unavailable.
Deployment responsibilities
The operator must configure lawful data handling, backup retention, privacy contact and hosting agreements for their jurisdiction. No compliance certification or absolute deletion from external providers is claimed.