// Privacy policy

Privacy

Last updated: 2026-09-10

What we collect

• Account identity — your GitHub user id, login, display name, avatar and email address when you sign in with GitHub, or your email address and password if you sign in with email. Sign-in is handled by Supabase Auth.
• Workspace metadata — organization and workspace names, membership roles, and the settings you choose (review mode, check schedule, report delivery destinations, CTO personality, connectors)
• Repository contents — for repositories you connect through the GitHub App: a bounded selection of files (READMEs, docs, manifests, configuration and CI files, and a small sample of source entry points) read to build the per-repo digest; the changed lines of a pull request when you turn on pull-request review; and a fresh shallow snapshot of the repository at one commit, held on our servers only while a scan or scheduled check runs and deleted when it finishes. Files whose purpose is to hold credentials (.env files, private keys, credential stores) are skipped before anything is read into a prompt, and file text is scrubbed of credential-shaped strings by pattern matching. See /llm-fallback for what reaches a model.
• Activity metadata — GitHub webhook deliveries (pushes, pull requests, reviews) and, when you connect a repository, a one-time backfill of the last 90 days or 100 commits on the default branch and the last 50 closed pull requests, including author and committer names and email addresses as recorded in Git metadata
• Derived artifacts — per-repo digests (six sections: identity, architecture, conventions, docs summary, hotspots and activity, and a symbol map, each stamped with the commit it describes and the files it cites, plus an architecture diagram), check reports, findings and suggested actions, judgments, pull-request review comments, research suggestions and, where enabled on our deployment, nightly repository and contributor dossiers
• Chat transcripts — messages between you and the CTO agent, the agent's tool activity, and any engineering-standard drafts
• Feedback — thumbs reactions on review comments (captured through GitHub reactions), "stop suggesting this" preferences on research suggestions, and feedback on findings
• Cost + observability data — per-session and per-job token usage, model cost, timings, and pipeline metrics

Processors we share data with

We use the following third-party processors strictly to deliver the service. Each has its own privacy practices.

• Anthropic — Claude API calls for digests, pull-request review, the CTO agent, reports and research; research suggestions also use Anthropic's web-search tool. See /llm-fallback for what is sent.
• GitHub — identity provider, and the GitHub App through which we read repositories and write check results, comments and pull requests
• Supabase — managed Postgres database and authentication
• Railway — hosting for the web app, the background worker and the agent runtime
• Resend — email delivery of reports you choose to send by email

Reports can also be delivered to Slack incoming webhooks or HTTP webhooks that you configure. Those destinations are chosen by you and are not our processors.

Retention

• Repository snapshots — held on our servers only while a scan or check runs and deleted when it finishes. Digest builds keep the derived sections and the paths they cite, not the files.
• Digests, reports, findings, transcripts, feedback and activity metadata — retained for as long as your workspace exists. We do not currently run automated purges; data is deleted on request (see Your rights).
• Cost + observability data — retained with the workspace for billing reconciliation, and may be kept after deletion as described in our /terms
• Account records — deleted within 30 days of a verified deletion request

Your rights

You can, at any time:

• Export reports from the dashboard (Markdown, HTML or PDF), and request an export of other workspace data by email
• Request deletion of your account and all associated workspace data by emailing privacy@ctoai.live. There is no self-serve deletion in the product yet.
• Revoke the GitHub App installation from GitHub, which removes our access to your repositories
• Turn pull-request review on or off for your workspace in Settings (it is off by default). Digest building has no per-workspace switch yet; see /llm-fallback

Contact

Privacy questions: privacy@ctoai.live. Security reports: /security.