Privacy

Privacy policy

Last updated

Repo Fleet signs you in, links your GitHub installations, and reads the workflow files in your repositories so you can edit them. This page says plainly what that means for your data: what we keep, what we never keep, and how to have all of it deleted.

What we store

Your account and what you connect to it live in our database:

  • Your email address, which is also your user name, and a hash of your password. We never store the password itself.
  • Whether your email address is confirmed, since an unconfirmed account cannot sign in.
  • Each GitHub installation you link: its id, the account that owns it, whether that account is a user or an organization, the permissions it granted, whether it is still connected, and when you linked and last refreshed it.
  • The repositories that installation grants: name, whether the repository is private, and its default branch. Your repository cards are drawn from this list.
  • The last workflow file you had open: its account, repository, branch, and file name, so the agents page reopens where you left off.

Your light or dark theme preference stays in your browser's local storage. It never reaches our server.

What we never keep

GitHub tokens. Connecting GitHub hands us a user token, which we use once to check that the installation you are linking is one you can see. Acting on an installation needs an installation token. Each is minted, used, and dropped inside the single request that needs it. Neither is ever written to our database or to our logs.

Repository content. Your workflow files, the branches and directories around them, and the actions and workflows they reference are read from GitHub when a page needs them, held only while that page is open, and never written to our database. A save goes to GitHub as a commit or a pull request; we keep no copy.

We do not sell your data, and we do not use it to train anything.

Cookies

The app sets three cookies, and all three are needed for it to work. The public pages at repofleet.ai set none.

  • An authentication cookie, which keeps you signed in.
  • An antiforgery cookie, which proves a form you submit came from a page we served.
  • A GitHub sign-in state cookie, which ties GitHub's redirect back to the browser that started it. It lasts fifteen minutes and is cleared as soon as the round trip finishes.

There are no analytics, advertising, or tracking cookies.

Who else sees your data

GitHub is the one third party we send your data to on your behalf. It is where your data comes from and where it goes back to: we call the GitHub API under the installation you linked, with the permissions that installation granted. GitHub also serves the public pages at repofleet.ai.

Three services carry Repo Fleet itself, and each sees only what it must to run it:

  • Resend delivers our email. Your address and the link the mail carries go to Resend so that a confirmation or a password reset can reach you, and only when a mail has to go out.
  • Microsoft Azure hosts the app. It runs on Azure App Service in the East US region, and our database sits there with it.
  • Google Fonts serves the typefaces on these pages, so your browser fetches them from Google the way it fetches any site's images. Nothing about your account travels with that request.

Repo Fleet is built and run from Ontario, Canada.

Deleting your account and your data

Email hello@repofleet.ai from the address your account uses and ask us to delete it. We delete the account, the installations linked to it, the repository lists under them, and your saved settings. Nothing of yours is kept afterwards.

You can cut off our access yourself at any time, without waiting for us: uninstall Repo Fleet from your account or organization settings on GitHub, and no token we mint can read anything again.

Changes to this page

Repo Fleet is early, and this page is written to be read rather than argued over. If what we do with your data changes, we change this page and move the date at the top. If a change is one you would want to know about, we email you rather than leave you to notice it.

Getting in touch

A person reads hello@repofleet.ai. Write there about anything on this page, including what we hold about you and what you want done with it.