Privacy Policy

We may collect the following categories of information:

• Account information. Your name, email address, profile image, account identifiers, authentication method, and related account settings. Authentication credentials are processed by Firebase Authentication. We do not receive your Google password or store plaintext passwords.
• GitHub and repository information. Your GitHub identity, GitHub App installation and authorization details, selected repositories, repository metadata, consent choices, and the temporary repository source needed to perform a scan.
• Scan information. Scan status and time, grouped findings, category, severity, confidence, occurrence counts, tasks, remediation plans, re-scan comparisons, and deletion status. Repository-relative paths and line numbers are retained only when you expressly choose that option for a scan.
• Billing information. Subscription status and customer, transaction, and billing identifiers. Stripe processes payment-card information; we do not store full card numbers.
• Communications. Messages, feedback, and support requests you send to us.
• Technical and usage information. IP address, browser and device information, timestamps, requested pages, security events, diagnostic data, and interactions with the Service. If you separately opt in, we may also add limited, de-identified scan counters to combined product-research statistics.

We receive information directly from you, automatically through the Service, and from services you connect, including Google, Firebase, GitHub, and Stripe.

We use information to:

• provide, operate, secure, troubleshoot, and improve HokuFetch;
• create and authenticate accounts and manage access;
• connect repositories you select, perform requested scans, and present findings, remediation plans, tasks, and comparisons;
• process payments and manage subscriptions;
• send service, security, billing, and support communications;
• detect fraud, abuse, and threats to the Service; and
• comply with law and enforce our agreements.

Where applicable law requires a legal basis, we process personal information to perform our contract with you, pursue legitimate interests such as operating and securing the Service, comply with legal obligations, or act with your consent.

HokuFetch requests read-only access to repositories you intentionally select. Repository source is processed in an isolated temporary workspace only to complete the scan. HokuFetch does not execute your repository code or write changes back to GitHub.

We do not retain raw code, source excerpts, matched secret values, source-derived hashes, archives, or absolute paths in scan results. Temporary repository source is automatically deleted within 24 hours of acquisition and is targeted for deletion within 60 minutes after a scan reaches a terminal state.

Scan results and remediation plans are generated without sending repository source, findings, or prompts to an AI model provider. Copying a remediation plan into a coding tool is your choice and occurs outside HokuFetch.

You must have authority to connect and scan a repository, including any personal information or third-party material it contains.

We do not sell your personal information or share it for cross-context behavioral advertising. We may disclose information:

• To service providers. Providers that help us host, authenticate, secure, support, and bill for the Service, including Google Cloud and Firebase, GitHub, and Stripe. They process information under their own terms and our applicable agreements.
• At your direction. When you connect a service, share a report, or otherwise direct us to disclose information.
• For legal and safety reasons. When reasonably necessary to comply with law, protect rights and safety, investigate abuse, or secure the Service.
• In a business transaction. In connection with a merger, financing, acquisition, reorganization, or sale of assets, subject to appropriate protections.

We retain information only as long as reasonably necessary for the purposes described in this Policy, including security, dispute resolution, and legal compliance.

• Temporary repository source is deleted on the schedule described in Section 3.
• Scan results, task progress, remediation plans, and related deletion evidence are generally retained for 90 days after scan completion unless deleted earlier with your account.
• Account and repository-connection control data is kept while needed to provide your account and the Service.
• Billing and transaction records may be kept as required for accounting, tax, fraud prevention, and legal obligations.
• Opt-in research statistics are aggregated without account, repository, or event-level identifiers and cannot later be associated with or deleted for an individual account.

You may request account and personal-information deletion by contacting us. We may retain limited information where legally required or necessary to protect the Service and its users.

Depending on where you live, you may have rights to request access to, correction of, deletion of, or a portable copy of personal information, and to object to or restrict certain processing. You may also withdraw consent where processing is based on consent. We will not discriminate against you for exercising an applicable privacy right.

You can disconnect repository access through HokuFetch or GitHub, manage billing through the customer billing portal, and control optional per-scan choices in the Service. To submit a privacy request or appeal a decision about one, email team@hokufetch.ai. We may need to verify your identity before completing a request. Residents of the EEA, UK, or Switzerland may also complain to their local data-protection authority.

HokuFetch uses cookies and similar browser storage that are necessary to authenticate you, protect connected-account flows, preserve your theme choice, and maintain basic session state. We do not use these technologies for third-party behavioral advertising. You can control browser storage through your browser, but disabling necessary storage may prevent parts of the Service from working.

We use administrative, technical, and organizational safeguards designed to protect information, including access controls, purpose-limited repository authorization, isolated processing, restricted worker networking, and bounded source retention. No internet transmission or storage system is completely secure. For more about our approach, visit the HokuFetch Security page.

HokuFetch is operated from the United States. If you access the Service from another country, your information may be processed in the United States and other countries where we or our service providers operate. Where required, we use legally recognized safeguards for international transfers.

The Service is not directed to children under 16, and we do not knowingly collect personal information from children under 16. If you believe a child has provided personal information to us, please contact us so we can take appropriate action.

We may update this Privacy Policy from time to time. We will post the revised Policy with a new “Last updated” date and provide additional notice when required by law.

For privacy questions or requests, contact: