Privacy Policy

Introduction

This Privacy Policy explains how RepoGuide collects, uses, discloses, and safeguards your information when you use our developer tool. RepoGuide is a platform that connects to your GitHub repository, analyzes codebase structure, and provides AI-powered onboarding documentation and Q&A. By accessing or using RepoGuide, you agree to the data practices described in this Policy.

Information We Collect

GitHub Account and Repository Information. When you sign in using your GitHub account, we collect the information you authorize during the OAuth flow. This includes your GitHub username (login), display name, avatar URL, and the email address associated with your account (where available through GitHub API). We also collect the repositories you authorize RepoGuide to access, including basic repository metadata such as repository name, full name (owner/name), description, primary language, visibility (public/private), star count, fork count, and default branch.

Repository Metadata and Source-Code Content

Repository Metadata. For each repository you analyze, we store metadata about the repository structure: detected programming languages, frameworks, package managers, entry points, important files, dependencies, and the directory tree structure. This metadata is derived from the codebase analysis and is used to generate the onboarding guide and architecture graph.

Source-Code Content Processing. When you authorize repository access, RepoGuide downloads the repository code into a temporary, isolated environment for analysis. The source code is processed to extract structural metadata (languages, frameworks, dependencies), generate AI embeddings for codebase QA and onboarding guides, and build the architecture graph. We do not permanently store your repository source code. After analysis completes, the code is deleted from our temporary processing environment. The extracted metadata (languages, frameworks, etc.) and AI embeddings may be retained to power the features you use.

AI Processing Data

AI Provider Calls. RepoGuide uses third-party AI providers to generate onboarding documentation and answer codebase questions. The following data is sent to AI providers:

• Code chunk snippets (portions of source code, limited to reasonable sizes for context windows)
• Repository metadata (languages, frameworks, detected patterns)
• User-generated questions (for codebase QA chat)
• AI-generated responses are streamed back to the UI and stored as chat history tied to your project

AI Providers Used. RepoGuide currently integrates with:

• Google Gemini (embedding model: gemini-embedding-2, 3072 dimensions) — used to create vector embeddings of code chunks for semantic search and codebase QA

Context Sanitization. Before any code is sent to AI providers, our server-side context system redacts potential secrets (API keys, passwords, tokens, environment variable values) and only allows real file paths that exist in the repository to survive. Generated documentation references only files that actually exist in your repository.

Technical and Session Information

Session Data. When you are signed in, we store a signed session cookie (repoguide_session) on your browser. This cookie contains an encoded user ID and expiration timestamp. The cookie is HttpOnly, uses SameSite=Lax, and is encrypted with HMAC-SHA256 using your GitHub client secret. It cannot be forged by third parties.

Usage and Analytics. We track usage metrics per user per month: repositories analyzed, AI questions asked, tokens consumed, storage used, and analysis runs. This data is stored in your user profile in our PostgreSQL database (Supabase) and is used to enforce Free plan limits (20 AI questions/month, 1 repository) and Pro plan quotas. We also record the period start/end dates for usage tracking.

Technical Data. Standard web server information such as IP addresses, browser type, operating system, and visit timestamps may be collected through standard web infrastructure. We do not use external analytics services (e.g., Google Analytics) or tracking pixels at this time.

Why We Process Your Data

We process the collected data for the following purposes:

• Repository Analysis. To download and analyze your repository code, detect languages/frameworks/dependencies, and generate the onboarding guide and architecture graph.
• AI-Powered Features. To provide codebase QA chat and AI-generated onboarding guides. This requires sending code context to AI providers.
• Account Management. To manage your user account, track usage limits, and provide appropriate plan features.
• Security and Integrity. To detect and prevent abuse, ensure fair usage, and maintain the integrity of the platform.
• Feature Improvement. To understand how the platform is used and improve the service (based on the usage metrics described above).

Data Retention

Repository Code. Repository source code is only downloaded into a temporary processing environment during analysis and is deleted after analysis completes. We do not permanently store your repository source code.

AI Embeddings and Metadata. Vector embeddings of code chunks and structural metadata (languages, frameworks, dependencies) are retained for as long as you keep your project in RepoGuide. These can be regenerated if the repository changes.

Chat History. Conversations in the codebase QA chat are saved per project and can be resumed. You can delete individual conversations or clear your chat history from the project settings.

User Account Data. Your account information (GitHub login, email, avatar) is retained for as long as your account exists. You can delete your account at any time via the Settings page, which will cascade-delete associated data per the database schema.

Session Cookies. Session cookies expire 30 days after creation or upon sign-out.

Usage Records. Monthly usage tracking records are retained for the current and prior billing periods to enforce plan limits.

User Rights

You have the following rights regarding your data:

• Access. You can view the data we have associated with your account by viewing your profile and project settings.
• Correction. You can update your name and email address through your account settings.
• Deletion. You can delete your account via the Settings page, which will remove your user data, associated projects, chat sessions, and usage records per database cascade rules. You can also request deletion of specific chat sessions.
• Export. You can download your generated onboarding guides and chat history from the project interface.
• Opt-Out of AI Processing. You can disconnect your GitHub account at any time, which will revoke RepoGuide access to your repositories. New analysis or QA will not be possible until you reconnect.

Third-Party Services

AI Providers. RepoGuide integrates with the following third-party AI services:

• Google Gemini — For code embeddings (vector search, codebase QA). When you use codebase QA or generate an onboarding guide, code chunk snippets and metadata are sent to Gemini. Gemini privacy policy applies to their processing of this data.

GitHub. RepoGuide authenticates users via GitHub OAuth and accesses repositories read-only based on the permissions you authorize during sign-in. The GitHub OAuth flow and repository access are governed by GitHub terms and your authorization choices.

Supabase (PostgreSQL). User data, including account information, project data, chat sessions, usage records, and AI embeddings, is stored in a PostgreSQL database hosted by Supabase. Supabase acts as our data storage provider and is subject to our data handling agreements.

Stripe. For Pro plan subscribers, payment processing is handled via Stripe Checkout. Stripe receives the minimum necessary information (email, payment details) to process subscriptions. No card details are stored on RepoGuide servers.

Disclaimer

Accuracy of Generated Documentation. RepoGuide AI-generated onboarding guides and codebase QA answers are produced by artificial intelligence. While we implement context sanitization and grounding techniques to ensure answers are based on your actual code, AI outputs may contain errors, omissions, or inaccuracies. The generated documentation and QA answers should be reviewed by a human before being relied upon for critical decisions. RepoGuide does not warrant that the generated content is error-free, complete, or up-to-date.

No Professional Advice. The generated content is provided for convenience and information purposes only and does not constitute professional advice, including but not limited to legal, financial, or technical advice. Always consult appropriate professionals for such matters.