Privacy & Security

1. Introduction

GitAlert is owned and operated by YS Progress Inc., a corporation incorporated in Ontario, Canada ("we", "us", "our"), which is the data controller for the personal information described in this policy. GitAlert is an independent check that triages pull requests — including those opened by AI coding agents — and posts one neutral label without blocking your merge. This policy explains what data we collect, how the GitAlert GitHub App handles your code, who we share data with, and the choices and rights you have. By using GitAlert you acknowledge the practices described here.

2. Data We Collect

We collect the following categories of data:

• Account data. When you sign in through a provider (GitHub, GitLab, Bitbucket, Google, DigitalOcean, or our Authentik single sign-on), we receive and store your name, email address, avatar, provider type, and a provider account identifier. If you add them, we also store profile details such as job title, team size, phone number, and links to your LinkedIn, X/Twitter, or GitHub profiles. We do not receive or store your provider password.
• Repository and pull-request data. When you install the GitAlert GitHub App, we receive and store metadata about your installation, the repositories you select, and the pull requests in them — see Section 3 for the exact detail.
• Payment data. If you subscribe to a paid plan, payment is processed by Stripe. We store a Stripe customer identifier and your subscription status; we do not store your full card number — card details are handled directly by Stripe.
• Website analytics and security logs. To operate the site and protect it from abuse, we record page views and authentication events. This includes your IP address, approximate country (derived from a network header, not a location database), browser, operating system, device type, preferred language, the page path, and any external referrer or UTM campaign tags. IP addresses are also recorded in our authentication log for security and fraud prevention.
• Support communications. If you contact us through the contact form, email, or the live chat widget, we receive the information you provide (such as your name, email, and message).

3. How the GitAlert GitHub App Handles Your Code

GitAlert connects to your Git provider through a dedicated application (the "GitAlert GitHub App"). It is separate from the account you sign in with. Here is exactly what it does and does not do with your code.

Permissions it requests

The App requests permission to read your pull requests and repository contents (so it can fetch the changes to analyse) and to write checks (so it can post its own neutral status on the pull request). It subscribes only to installation and pull-request events. Within those permissions, GitAlert never pushes commits, changes your branches, merges or closes pull requests, or posts comments — the only thing it creates is its own informational check-run.

What we store

For each installation, repository, and pull request we store metadata:

• Installation and account: the installation id, your account login, account type, and account id.
• Repository: the repository id, full name, default branch, and whether it is private.
• Pull request: its number, state, title, description text, author username, whether the author looks like an AI agent, an automation bot, or a person, the branch names and commit identifiers, and the pull-request URL and timestamps.
• Verdict: the label we produced, the confidence, and the specific findings behind it (for example the file and line of a weakened test, the name of a package that could not be found on a registry, or the path of a sensitive file that changed).

What we do not store

To produce a label we fetch the pull request’s diff and analyse it in memory. We do not store the diff or your source code. We do not store your GitHub access tokens in our database (they are minted on demand and held in our short-lived in-memory cache for up to 50 minutes, the lifetime GitHub gives them, so we do not re-mint one for every request), and we do not store the full webhook payloads GitHub sends us — only the small set of fields listed above.

Dependency checks

When a pull request adds a new package, GitAlert checks whether that package name exists on the relevant public registry (PyPI for Python, npm for JavaScript, Packagist for PHP, crates.io for Rust, the Go module proxy for Go, RubyGems for Ruby). This sends the package name only — never your code — to that registry.

Sandbox runs (paid plans, optional)

On paid plans you can enable sandbox runs, where we build your project and run its existing tests to see whether the change actually holds up. This runs in an isolated, single-use environment operated by our sandbox provider (Daytona) that is destroyed after each run. The sandbox clones your repository over HTTPS, runs with a default-deny network policy that only permits your Git host and the public package registries, receives no secrets or credentials from us, and is fully separated from our own systems. On the free plan we never execute your code — triage is based only on reading the diff.

4. How We Use Your Data

We use the data above only to:

• Provide the service — triage your pull requests, post checks, and show your results in the dashboard.
• Operate billing and subscriptions.
• Secure the service, prevent abuse, enforce plan limits, and debug problems.
• Understand aggregate product usage so we can improve GitAlert (analytics run by default and stop when you choose “Essential only” — see Section 5).
• Respond to your support requests and, where you have opted in, send you product communications.

We do not sell your personal data, and we do not use your source code or pull-request contents to train machine-learning models.

5. Cookies and Tracking Technologies

We use essential cookies to run the site (session, security, and your saved cookie choice). Analytics cookies — Google Analytics and Microsoft Clarity — and our self-hosted support chat load by default, and stop as soon as you choose “Essential only” in our consent banner. We treat a browser Global Privacy Control signal the same way. You can change your choice at any time through the “Cookie preferences” link in the footer. Full detail is in our Cookies Policy.

6. Sub-processors We Share Data With

We do not sell or rent personal data. We share the minimum necessary with the service providers below, each of which processes it only to provide their service to us:

Our Authentik single sign-on runs on our own infrastructure at key.gitalert.com, and our live support chat is self-hosted too — chat messages go to our own server, not to a third-party chat provider. We may also disclose data where required by law or to protect our rights, users, or the security of the service.

7. International Data Transfers

We are based in Ontario, Canada, and several of our sub-processors are located in the United States and other countries. Using GitAlert therefore involves transferring your data across borders, including to the United States. Where the law requires it, we rely on appropriate safeguards (such as Standard Contractual Clauses) offered by those providers.

8. Data Security

We protect your data with measures including:

• Encryption of all traffic in transit (TLS).
• Signed, verified webhooks — every GitHub webhook is checked with a constant-time HMAC signature and rejected if it does not match.
• GitHub access tokens minted on demand, cached in memory for up to 50 minutes, and never stored in our database.
• Sandbox execution isolated from our systems, with default-deny networking and no credentials passed in.
• Optional multi-factor authentication (TOTP) on your account, and restricted internal access to personal data.

No system is perfectly secure. In the event of a data breach that affects you, we will take reasonable steps to notify affected users and mitigate harm.

9. Data Retention

We keep personal data only for as long as it is needed for the purposes in this policy, or as required by law.

• Account and repository/pull-request data is retained while your account and installation are active. When you uninstall the GitAlert App from a repository, we stop receiving its data; you can request deletion of your account data as described below.
• Pull-request diffs and source code are not retained — they are analysed in memory and discarded.
• Website analytics and security logs (including IP addresses) are retained for security, abuse-prevention, and analytics purposes. If you would like your analytics or log records associated with you removed, contact us and we will action reasonable requests.

If you would like a specific retention period documented for your organisation, contact us and we can discuss it.

10. Your Rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, to object to or restrict certain processing, and to turn off analytics at any time (via the cookie banner’s “Essential only” choice). To exercise any of these rights, email us at [email protected]. You may also uninstall the GitAlert App from any repository at any time from your Git provider, which immediately stops new data from flowing to us. If you are in the EEA or UK, you also have the right to lodge a complaint with your local data protection authority.

11. Children’s Privacy

GitAlert is a tool for software developers and is not directed to children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us data, contact us and we will delete it.

12. Changes to This Policy

We may update this policy from time to time. The current version, with its “Last updated” date, is always posted on this page. Material changes will be reflected here.

13. Contact and Complaints

For any question, request, or complaint about your privacy, contact YS Progress Inc. at [email protected]. We take privacy seriously and will do our best to help.