Privacy Policy

1. Who We Are

ArchSetu ("we", "us", "our") is an engineering intelligence platform that provides static code analysis for GitHub repositories. This Privacy Policy explains what data we collect, how we use it, and the choices you have.

If you have questions about this policy, contact us at coder@archsetu.com.

2. Data We Collect

• Account data (if you sign in): Your GitHub username or email address, avatar URL, and user ID. We do not collect your password in plain text.
• Repository metadata: When you submit a GitHub URL for analysis, we store the repository name, owner, description, primary language, star count, and whether the repository is public or private. We do not store your source code.
• Analysis results: We store the computed results of our analysis: health scores, function counts, dead code lists, call graph data, and complexity reports. These are derived numbers and structures, not your source code.
• Usage data: API endpoint hits, analysis timestamps, and plan tier for rate limiting purposes.
• Log data: Server logs contain IP addresses, request paths, and timestamps. Logs are retained for 30 days and are never sold.

3. What We Never Collect

• Source code: We clone your repository temporarily to run the analysis, then delete the clone immediately. We never store, log, or transmit your source code to any third party.
• File contents: Our analysis engine reads file contents in memory during analysis only. File contents are never written to our database.
• Private keys or secrets: If your repository contains secrets (which it should not), we never store them. We also do not scan for secrets.

4. GitHub OAuth Tokens

If you connect your GitHub account, we store your GitHub OAuth access token to enable private repository analysis. This token is encrypted at rest using AES-256-GCM encryption before being stored in our database. The encryption key is stored separately from the database.

We request only the minimum required GitHub scopes: read access to your repositories. We never request write access.

5. How We Use Your Data

We use your data to:

• Provide the core analysis service
• Cache analysis results to avoid re-analyzing the same repository unnecessarily
• Generate shareable report URLs
• Send weekly health score digests (if you opt in)
• Rate limit requests to prevent abuse
• Improve the accuracy of our analysis engine (using aggregate, anonymized metrics only)

6. Data Sharing

We do not sell your data. We do not share your data with advertisers.

We share data only with the infrastructure providers necessary to run the Service - a managed database provider, a web application hosting provider, a cloud compute provider for background analysis processing, and a caching provider for rate limiting. Each is bound by a data processing agreement and none may use your data for their own purposes.

We never share the technical details of your repository - its programming languages, frameworks, dependencies, function names, or any other code characteristics - with any third party, advertiser, or data broker. This information is used exclusively to generate your analysis report.

Public repository analysis results may be publicly accessible at their report URL (archsetu.com/r/owner/repo) because the source code is already public. Private repository results are never publicly accessible.

7. Data Retention

Analysis results for public repositories are retained indefinitely to power the Explore page and caching.

Analysis results for private repositories are retained for 90 days after your last activity, then deleted.

If you delete your account, all personal data (account info, tracked repos, private analysis results) is deleted within 30 days.

8. Your Rights

You have the right to:

• Access: Request a copy of all data we hold about you
• Deletion: Request deletion of your account and all associated data
• Correction: Request correction of inaccurate personal data
• Portability: Request your analysis results in JSON format

To exercise these rights, email coder@archsetu.com. We will respond within 30 days.

9. Cookies

We use a single session cookie for authentication (next-auth.session-token). This cookie is HTTP-only, Secure, and SameSite=Lax. We do not use third-party advertising cookies.

We use PostHog for product analytics in cookieless mode where possible. You can opt out of analytics at any time by emailing coder@archsetu.com.

10. Security

We apply the following security measures:

• OAuth tokens encrypted with AES-256-GCM before database storage
• All data in transit encrypted with TLS 1.2 and above
• Cloned repositories deleted immediately after analysis in a finally block (deleted even if analysis fails)
• Row Level Security (RLS) enforced at the database level
• Rate limiting on all API endpoints
• Webhook signatures verified using timing-safe comparison

11. Changes to This Policy

We may update this Privacy Policy. If we make material changes, we will notify users via email (if you have an account) or by posting a notice on our website. Continued use of ArchSetu after the effective date constitutes acceptance of the updated policy.