Privacy policy

Boswell audits the code of repositories you connect and tells you what to fix before and after launch. This page says what data that involves, who processes it, and how to have it deleted.

What we collect

• Your GitHub account: name, email address, avatar, and a GitHub access token. The token lets Boswell list your repositories, clone the ones you choose to audit, and open pull requests you ask for. We never push to your default branch or merge anything.
• Repository code: each audit clones the repository into a temporary workspace that is deleted when the audit finishes. We keep the results — findings, file paths and line numbers, short excerpts, scores and reports — not a copy of your code.
• Live verification details (only if you set it up): your staging URL and the two test accounts you provide. Test account passwords are stored encrypted and used only to run the checks you start.
• Billing: handled by Stripe. We store your plan and Stripe customer ID, never your card details.

Who processes it

• OpenRouter and the AI model providers it routes to, which receive parts of your code during an audit to produce the analysis.
• GitHub (sign-in, repository access, and GitHub Actions, where audits run).
• The npm registry, which receives your dependency list (package names and versions) when we check for vulnerable packages. Your code is not sent.
• Vercel (hosting), Neon (database), Stripe (payments), Resend (email), and Sentry (error reports — the error and stack trace only, no request contents, cookies or personal data).

We don't sell your data or use it for advertising.

How long we keep it

Audit results are kept so Boswell can track your repository over time. When you ask us to delete your account, we delete your account, tokens, repositories, audits, findings and verification settings. Revoking Boswell's access in your GitHub settings stops all further access immediately.

Your rights

You can ask for a copy of your data, a correction, or deletion at any time by replying to any email Boswell has sent you. We'll respond within 30 days.

Changes

If this policy changes in a way that matters, we'll update the date above and tell signed-in users.