Spaccato · Beta
Privacy Policy
This policy says what Spaccato reads, keeps and shares, and why. Spaccato is operated by Wildbit, LLC (“we”) and is in beta, by invitation; the policy will be revised before the product is generally available. It covers the site at spaccato.dev and the Spaccato GitHub App, and the Terms of Service are the agreement for using them. Wildbit’s other sites have their own policy.
What we read and keep
Only what the service needs:
- Your GitHub account, when you sign in: your GitHub id, login, display name and avatar, and a token for your account, stored encrypted, which we use to list the installations and repositories you can see on GitHub. We do not store your email address, and we never see your password.
- Installations: the GitHub account the App is installed on, the names and ids of its repositories, the settings chosen for it, and what you write in Settings about who reads the cards.
- Pull requests and runs: the pull request’s number, title, description, author and branches, who asked for a run, and the names and states of its checks. During a run we read the commit messages, the diff, the files the model needs and an archive of the repository at the pull request’s head. The text the model read is deleted when the run ends. What stays is the card, which can quote lines of code, with the run’s status, model, token usage and cost.
- Organization roles: for an organization we ask GitHub whether you are an owner, to decide who may change its settings and connect a payment key.
- OpenRouter keys an account connects to pay for its own runs, stored encrypted, with the label, limit and usage OpenRouter reports.
- From your terminal, when you use the command: the change you ask it to explain (the diff, the files the model may read, which the command trims to what fits, and your conversation with the coding agent as the command digests it: your prompts and the agent’s replies, never its tool output). It is held only while the card is written, then deleted; the card stays. A personal token you create in Settings stands for you in the command; we keep only its hash.
- Operational records: the steps, timings and errors of each run for 90 days, webhook delivery ids for 14 days, and our hosting provider’s request logs for a short period.
- Cookies: four of our own and no analytics or advertising: an encrypted session, a signed-out marker, a short-lived state cookie during sign-in, and your theme. We do not track you across sites, so Do Not Track signals change nothing.
Why
To provide the service: fetch the pull request, write and show the card, post the comment and check who may do what. To run it: find failures, measure cost and keep it secure. Under the GDPR and the UK GDPR, the basis for people who sign in is our contract with you; for the authors and reviewers whose names and words appear in the pull requests we process, and for operational records, it is our legitimate interest in providing the service the repository’s owner asked for. We do not use your content to train models and we do not sell personal information.
Where it goes
- GitHub, the source of everything we read and where the card is posted as a comment.
- Vercel (United States) runs the application.
- Supabase (on AWS in Canada) hosts the database.
- OpenRouter (United States) forwards each analysis to the provider of the model chosen in Settings. The default model is Anthropic’s Claude, served by Anthropic, Google Cloud or Microsoft Azure. We ask OpenRouter for routes whose providers do not train on what they receive and do not store it beyond a short window for abuse monitoring; for Anthropic that window is up to 30 days.
Nobody else, unless the law requires it or you ask us to. The card is visible on GitHub to everyone who can see the pull request, on this site to people with access to the repository on GitHub, and to anyone holding a share link that one of them created. Our administrators see counts, who pays and spending per installation, not the cards. Your data is processed in the United States and Canada; for people in the EEA, the United Kingdom or Switzerland we rely on standard contractual clauses or equivalent safeguards with these providers.
How long we keep it
- The text the model read: until the run ends. A change sent from your terminal: until its card is written, minutes.
- Run steps and errors: 90 days. Webhook delivery ids: 14 days.
- Cards, pull request snapshots and run records: as long as the installation exists. Uninstalling the App marks the installation removed and stops all reading. The stored records are deleted within 30 days of your request, and we intend to make uninstalling delete them automatically before general availability.
- Your GitHub token: until GitHub reports it invalid or you ask us to delete your account. A connected OpenRouter key: until it is disconnected. A personal token for the terminal: until you revoke it. Cards from your terminal: until you ask us to delete them.
- Database backups kept by our provider age out on its schedule after that.
Security
Everything travels over TLS. GitHub tokens and OpenRouter keys are encrypted at rest with AES-256-GCM under a key derived from a server secret, and the database is encrypted at rest by its provider. The App asks GitHub only for what it needs: read access to code, metadata, checks, commit statuses and organization membership, and write access to issues and pull requests to post its comments. Access to production is limited to the people who run the service. To report a security problem, write to privacy@wildbit.com.
Your rights and choices
The dashboard and Settings show most of what we hold about you. Write to privacy@wildbit.com to access, correct, export or delete your data, or to object to a use of it; we answer within 30 days. Uninstalling the App stops all reading and all new runs at once. If you are in the EEA or the United Kingdom you may also complain to your supervisory authority. If you live in California: we do not sell personal information or share it for advertising, and the rights above are yours.
Children
The service is for people who work with code and is not directed at anyone under 16. We do not knowingly collect information about them.
Changes
We will revise this policy as the product changes and update the effective date at the top. A change that matters will be announced on the front door or by email before it takes effect, and signing in afterwards records your acceptance of the new version.
Contact
Wildbit, LLC, 41 University Drive, Suite 400, Newtown, PA 18940, USA. Email privacy@wildbit.com.