Privacy

What the App reads

Only allowlisted configuration metadata files (listed in the documentation) from repositories where the App is installed, using short-lived installation tokens.

What the App stores

• Webhook delivery IDs (deduplication) and installation IDs (cleanup accounting).
• Short-lived, single-use handoff context limited to: source surface, finding category, asset type, operator intent, created-at, expires-at.

What the App never stores

• No raw repository file content — content is analyzed in memory and discarded.
• No prompts, secrets, or tool payloads.
• No hidden telemetry: operational logs are redacted and contain no file content or tokens.

Uninstalling

Uninstalling the App removes its stored installation records. Repository access ends immediately when GitHub revokes the installation.