Privacy Policy

This Privacy Policy explains how DevAudit, Inc. (“DevAudit”, “we”, “us”) collects, uses and shares personal information when you use the DevAudit website, dashboard, command-line tool (CLI), public API and GitHub integration (together, the “Service”).

For account and usage data, we act as the controller (or “business”). For the code, error data and other content you submit to the Service, we process it on your behalf and on your instructions. If you need a data processing agreement, contact us using the details in Section 13.

• Account information. You sign in with GitHub. We receive your GitHub user ID, username, email address and the basic profile details GitHub shares with us.
• GitHub access. At sign-in we request GitHub’s `repo` permission, which GitHub treats as broad read and write access to the repositories you can access, including private ones. DevAudit uses it to read your repositories and, only when you ask for it (for example, applying a suggested fix or committing from the code editor), to create branches and commits, create new repositories and change a repository’s public or private setting. Our servers only make a fixed set of GitHub API calls on your behalf. We store the resulting GitHub access token, encrypted, on our servers so the dashboard, CLI and API can act for you. You can revoke access at any time in your GitHub settings.
• Repository, project and error data. Repository and project names, file paths, commit SHAs, source-code excerpts, error messages, stack traces, severity, causes, suggested fixes and patches, and project membership and roles.
• Environment variables. Values you save for deployments are encrypted at rest. They are decrypted on our servers only at deploy time and sent to the hosting provider you selected.
• Deployment credentials. Access tokens (for Vercel, Netlify, Cloudflare, Render or GitHub) or webhook URLs you enter to deploy. We use them only to carry out that request and do not store them in our database.
• API tokens. We store a one-way hash of each token, its name, a short non-secret prefix, and created, last-used and revoked timestamps. The full token is shown to you once.
• AI feature inputs. Your prompts, code excerpts, file names, error details and dependency manifests (such as package.json or requirements.txt) that you submit to our AI features. Deployment recommendations use only file names, dependency manifests and environment variable names, never variable values. AI Assistant chat history is kept in your browser’s local storage.
• Collaborator information. When you invite someone, we look them up by GitHub username or email. Members of a project can see each other’s username or email.
• Technical and security data. IP address (IPv6 addresses are reduced to their network prefix), request timestamps and basic device and browser information, used for rate limiting, abuse prevention and operating the Service. Our infrastructure providers also keep standard server logs.
• Messages you send us. Anything you share when you contact us, for example through Discord or email.

We use your browser’s local storage, not advertising cookies, to keep your sign-in session and to remember preferences and work in progress: theme and layout settings, onboarding state, cached project files, bug logs, test-run summaries and AI Assistant conversations. This storage is essential to how the Service works. You can clear it in your browser settings, but you may be signed out and lose unsynced local work.

As of the effective date we do not use third-party analytics or advertising trackers. If that changes, we will update this policy and ask for consent where the law requires it.

• Provide the Service: authenticate you, connect repositories, record and analyze errors, generate explanations and fixes, and run deployments you request.
• Keep the Service safe: rate limiting, abuse and fraud prevention, debugging and security monitoring.
• Communicate: respond to requests and send service-related notices.
• Improve the Service: understand reliability and performance and fix problems.
• Comply with the law: meet legal obligations and enforce our Terms of Service.

We do not use your code or error data to train our own AI models, and we do not sell your personal information. The third-party AI providers described in Section 6 handle your inputs under their own terms, which we do not control.

Where the GDPR or UK GDPR applies, we rely on: performance of our contract with you (providing the Service); our legitimate interests (security, abuse prevention, reliability and improving the Service); your consent, where we ask for it, which you can withdraw at any time; and compliance with legal obligations.

To power features such as error explanations, suggested fixes, the AI Assistant and deployment recommendations, we send the inputs described in Section 2 to third-party AI inference providers, currently OpenRouter and Groq, and to the model providers they route to. We try several models in sequence, and some may be free-tier models.

These providers process your inputs under their own terms and privacy policies. Free-tier models in particular are often offered on looser terms: the provider serving a request may log your inputs and may use them to improve or train its own models. We cannot control or guarantee how any provider retains or uses that data. Please do not submit secrets, credentials, personal data or code you are not comfortable sharing in prompts or code excerpts you send to AI features.

• Infrastructure providers: Supabase (database and authentication) and our hosting provider (currently Vercel).
• GitHub: to read repositories and, when you ask, write branches and commits.
• AI providers: OpenRouter, Groq and the underlying model providers (Section 6).
• Deployment platforms you choose: Vercel, Netlify, Cloudflare, Render, GitHub Pages or a custom webhook receive your project files and environment variables when you deploy.
• Collaborators: people you add to a project can see its data and your username or email.
• Legal and safety: when required by law or to protect rights, safety and the security of the Service.
• Business transfers: in a merger, acquisition or sale of assets, subject to this policy.

We do not sell personal information or share it for cross-context behavioral advertising.

Our primary database is hosted in the UK (London), and our providers may process data in other countries, including the United States. Where required, we rely on safeguards such as the UK International Data Transfer Agreement or Addendum, the European Commission’s Standard Contractual Clauses, or equivalent mechanisms.

We keep account, project and error data until you delete it or your account, or ask us to. Rate-limiting records are kept only as long as needed for abuse prevention. After deletion, residual copies may remain in backups for a limited period, and we may keep information we are legally required to retain.

We protect data with TLS in transit, AES-256-GCM encryption for stored environment variables and GitHub access tokens, one-way hashing of API tokens, and row-level access controls on our database. No system is perfectly secure, so we cannot guarantee absolute security. Keep your GitHub account and API tokens safe, and tell us right away if you suspect misuse.

Depending on where you live, you may have the right to access, correct, delete, restrict or object to our processing of your personal information, to data portability, and to withdraw consent. If you are in California, you also have the right to know what we collect, to delete it, to correct it, and not to be discriminated against for exercising these rights. EEA and UK residents may also complain to their local data protection authority.

To exercise a right, email sean@devaudit.lol. We may need to verify your identity first. You can also disconnect DevAudit from GitHub in your GitHub settings and delete projects, environment variables and API tokens in the dashboard.

The Service is not directed to anyone under 16, and we do not knowingly collect their personal information. If you believe a child has given us data, contact us and we will delete it.

We may update this policy from time to time. We will post the new version here with a new effective date and, for material changes, give additional notice.

DevAudit, Inc.. Email: sean@devaudit.lol.