Privacy

You send us your source code. So here is exactly what happens to it — in plain language.

What goes to TypeSafe

For each pull request we send only the changed function scopes to api.typesafe.ai (our scoring provider, TypeSafe) — per scope: the file path, the function name, the function's source, and the diff hunk. Never whole repositories, never unchanged files. The CLI submits SHAs plus the diff; the diff is held transiently and cleared when the scan finishes. TypeSafe is the only external party that ever sees your code, and it sees only these scopes.

What we store

Per finding we store metadata only: file path, line number, function name, verdict, probability, and finding family. No source code, no diffs, no finding text — the intake serializer drops those fields before anything is written. Our logs hold only ids and hashes, never code, diffs, keys, or finding content. API keys are stored as SHA-256 hashes (the raw key is shown once, at creation); 2FA secrets are encrypted at rest.

Retention

• Verification and password-reset tokens: 1 hour, single use.
• Sessions: until you sign out (or reset your password).
• Rate-limit counters: pruned automatically on a rolling window.
• Scans and findings: kept with your workspace until you delete your account. There is no automatic expiry job yet — when we switch one on (planned: 30 days for findings), this page will say so first.
• Credit ledger (payments): 7 years (Dutch fiscal retention), anonymised after account deletion — amounts without name, e-mail, or any other identifier.

Delete your account

Deletion starts from settings, after confirming your password (or a fresh sign-in), with a 14-day grace period instead of instant erasure. A nightly job purges your data after the grace passes (sole-owned workspaces included); the credit ledger is kept 7 years anonymised, never re-identifiable. Before that you can request an export of your data (GDPR art. 20) from the same page.

What goes: profile, workspaces you solely own, sessions, API keys, scans, and findings. What stays: the credit ledger — anonymised, never re-identifiable. If you own a workspace with other members, transfer ownership or delete the workspace first — a workspace is never left ownerless.

Subprocessors

• TypeSafe — code scoring (changed scopes only).
• Neon — Postgres hosting (all stored data).
• Vercel — web hosting (EU region).
• Resend — verification, reset, and budget e-mails.
• GitHub — sign-in and the GitHub App (if you connect it).

Stripe is built in test mode only — no payment data is shared with anyone until live billing starts.

Contact

Questions about your data? Start from /docs and we will point you to the right address.