Last updated: March 12, 2026
RepoReady (“we,” “us,” or “our”) operates the RepoReady service at repoready.app. This Privacy Policy explains what information we collect, how we use it, and the choices you have. We keep this simple because we run a small, focused service — not an ad network.
When you sign in via GitHub OAuth, our authentication provider (Clerk) receives your GitHub username, email address, and profile photo. We store your Clerk user ID and, when you subscribe, your Stripe customer ID. We do not store passwords.
RepoReady requests read access to your GitHub repositories so we can fetch file contents for scanning. Your GitHub OAuth access token is held by Clerk — it is never stored in our database or application servers. We use the token only to list your repos and fetch files during an active scan.
When a scan runs, we fetch selected files from your repository (API routes, middleware, environment config patterns, payment code). We store the following about each finding:
Full file contents are never stored in our database. We do not store file content beyond the 10-line snippet.
Payment processing is handled entirely by Stripe. We never see or store credit card numbers. We store your Stripe customer ID and subscription status (active, past_due, canceled) to gate access to paid features.
We collect basic server logs (IP address, request path, timestamp) for security monitoring and rate limiting. We do not use third-party analytics trackers like Google Analytics.
We do not sell your data. We do not use your repository code or findings to train AI models. We do not share your data with third parties for advertising purposes.
We share your data only with the following service providers, solely to operate RepoReady:
Every scan generates a public report URL at repoready.app/reports/[id]. This page shows the top 3 findings from your scan and is intentionally crawlable by search engines (for viral distribution). If you do not want a report indexed, you can avoid sharing the URL — reports are not listed anywhere on our site. We do not currently provide a deletion mechanism for individual reports, but you may contact us to request deletion.
We retain your scan data and account information for as long as your account is active. If you delete your account, we will delete your scan history, findings, and personal information within 30 days. Stripe retains billing records independently per their own policy.
We enforce HTTPS on all endpoints. GitHub tokens are stored by Clerk and never written to our application database. Database access uses short-lived credentials via Neon. We apply rate limiting to all scan-trigger and auth endpoints. Code snippets stored in our database are capped at 10 lines and never include the surrounding context that would make secrets extractable.
Depending on your location, you may have rights to:
To exercise these rights, email us at privacy@repoready.app.
We use session cookies set by Clerk for authentication only. We do not use advertising cookies or third-party tracking pixels.
RepoReady is not directed at children under 13. We do not knowingly collect data from children. If you believe a child has provided us with personal information, please contact us and we will delete it.
We may update this policy as the service evolves. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify active subscribers by email. Continued use of the service after changes constitutes acceptance of the updated policy.
Questions about this policy? Email us: privacy@repoready.app