Privacy Policy.

This policy covers the hosted Devolyn Guard service at devolyn.com, app.devolyn.com and api.devolyn.com (the “Service”), including the Devolyn Guard GitHub App. It does not cover self-hosted installations, where the software runs on the customer’s own infrastructure and we receive none of their data.

When you install the Devolyn Guard GitHub App on a repository, GitHub notifies us about pull requests. We then read the changed files and the repository’s structure to analyse them. We never execute your code and never write to your code. The App cannot change your files, workflows or repository settings. We post our result back to the pull request as a check and, when a change is blocked, a comment.

We do not sell personal data, use it for advertising, or use your code to train AI models. Devolyn Guard is deterministic and does not use AI models to analyse your code.

• Source code and its structure: only what verification needs. Only the latest analysed version of each repository’s structure is kept; older versions are deleted automatically when a newer one is built.
• When you uninstall the GitHub App, or ask us to delete your organisation’s data, we delete all of your source code and everything derived from it: file contents, code excerpts, file paths, the code structure, and the repository connection.
• Audit records (kept after deletion): Devolyn Guard keeps a tamper-evident audit log of its decisions. It is technically append-only, and nothing in the Service can alter or erase it. That is what makes it trustworthy as evidence. After deletion, these records still contain the repository name; function and module names mentioned in impact findings, and line numbers; verdicts, rule names, our own rule messages, and timings; your email address only for actions a person took (for example signing in or inviting a user) — verifications made through the GitHub App are recorded under a machine identity, not your email; and policy text you wrote, if you authored a policy. They never contain your file contents, code excerpts, secret values or file paths. Audit records are kept for as long as the Service operates. Because they cannot technically be altered, we cannot erase them on request. If you ask, we will tell you exactly which audit records relate to you.
• Account data: for as long as your account exists. An account that approved actions is deactivated rather than deleted, so audit records stay meaningful.
• Security logs: 90 days.

Your data is stored in Germany. If you are outside the EU, using the Service involves transferring your data to the EU and through our providers’ networks.

Each customer’s data is isolated in the application and by database row-level security. Connections use TLS. Passwords are hashed with argon2id. The GitHub App’s private key and other secrets are kept in server configuration, never in the database or in code. No system is perfectly secure. If a breach affects your personal data, we will notify you and the relevant authorities as the law requires.

What the GitHub App can and cannot do →

You can access, correct and delete your account data, and you can remove the GitHub App at any time from your GitHub settings, which triggers deletion as described in section 4. Write to [email protected] for any request or grievance. We aim to reply within 30 days. The one limit is the audit records described in section 4, which cannot be erased. If you are not satisfied with our response, you may complain to the data protection authority where you live (in India, the Data Protection Board of India).

The Service is not intended for people under 18.

We will post changes here and, for material changes, notify account holders by email before they take effect.