PrivacyPolicy
We respect your code. Here is exactly what we read, what we store, and what we never touch.
Core Commitments
Your Code Stays Yours
We only access code to analyze it. We never claim ownership or share your code with third parties.
Zero Model Training
Your private repositories, diffs, and pull requests are never used to train public AI models.
Minimal GitHub Scopes
Read-only access for syntax parsing; write access strictly to post review comments on your PRs.
Delete Anytime
Disconnecting a repository permanently deletes its vector index and analysis history.
Table of Contents4 Sections
What We Read & How We Process It
GitCaptain connects to your GitHub repositories to parse syntax trees (using Tree-sitter), map dependencies, and review pull requests.
To do this work, our workers fetch relevant files and diffs directly from GitHub over encrypted TLS 1.3 connections. Analysis runs entirely in short-lived worker memory. We do not keep persistent git clones on disk, and temporary buffers are wiped as soon as analysis completes.
If you disconnect a repository from your dashboard, its vector embeddings and associated dependency maps are permanently deleted.
AI Models & Zero Model Training
We know that inviting an external tool into private repositories requires trust. Our primary rule is simple: GitCaptain never uses your proprietary code or pull requests to train, fine-tune, or improve public AI models.
- Zero Retention Endpoints: When AI models (Gemini, Groq, Mistral) are used for PR reviews or chat, requests route through enterprise zero-data-retention APIs that do not log or store code for training.
- Bring Your Own Keys: If you configure your own API keys on the API Keys page (
/apis), requests route directly to that provider under your personal account terms.
Data We Store & GitHub Scopes
We keep our data footprint minimal and transparent:
Account & Keys
Your GitHub username, email, avatar, and encrypted API keys (AES-256 at rest, decrypted only in memory during requests).
Analysis Findings
Health scores, complexity metrics, and review comments for your dashboard. We store the diagnostic findings, not copies of your repository.
GitHub Scopes
Read-only access to repository contents (for AST parsing) and write access to PRs and check runs (to post reviews). We never request admin, billing, or repo deletion rights.
Your Control & Contact
You have complete ownership of your data. You can disconnect repositories or delete your account at any time from your settings to immediately wipe all stored records.
If you have questions or need a signed Data Processing Addendum (DPA) for your team, email us directly at privacy@gitcaptain.com.
Have questions about our legal or security policies?
Our engineering & compliance teams are available at legal@gitcaptain.com or through our Contact portal.