Legal

Privacy Policy

Last updated 15 October 2026

This policy explains what GitHub Backup Observatory collects, why, who else handles it and how you can see, correct or delete it. The data fiduciary is Shardendu Mishra, Hyderabad, Telangana, India. It is written to meet India’s Digital Personal Data Protection Act, 2023.

What we never collect

  • The contents of your repositories. The agent on your machine writes the archives straight to your storage.
  • The credentials of your storage, and the agent’s GitHub login: they stay on your machine (in its configuration and the operating system’s keychain).
  • The GitHub token used when you sign in. We use it once, to read your profile and primary email address, and do not store it.

What we collect

  • Account: your GitHub user id, login, display name and primary email address, your plan, and when the account was created. A signed session cookie keeps you signed in.
  • Linked machines and tokens: each agent’s name, host name, version and when it was last seen. Access tokens are stored only as SHA-256 hashes.
  • Backup runs: repository names, sizes, commit hashes, timings, results, error messages and the log lines the agent sends, why the agent backed each repository up, how long each step took, byte counts and the outcome of its storage checks, the agent’s version, operating system and storage type, and statistics about a git destination (commit, branch, tag and file counts, sizes, and its latest commit’s hash and message).
  • AI assistant: your conversations, the tools the assistant ran, its investigations, and search indexes of your run history and conversations. A connected OpenRouter key is stored encrypted; we show only its last characters.
  • Account activity: a log of changes such as tokens created, machines linked and agents revoked.
  • Payments: Razorpay’s payment id, the amount, the currency and the status. Card, UPI and bank details go only to Razorpay, under its own privacy policy.
  • Research telemetry: only if you turn it on; see the Terms of Service, section 5.
  • Waitlist: if you join it, your email address and the page you used.
  • Server logs: the address, path, status and timing of each request to our servers, used to keep the service running and to stop abuse.
  • Visits: page views counted by Vercel Web Analytics, which uses no cookies.

Why we use it

  • To run the service you asked for: runs, the dashboard and the assistant.
  • To bill you, answer support requests and prevent abuse.
  • To tell waitlist members when pre-orders open or the service launches.
  • Research telemetry is used only if you turn it on (see the Terms of Service, section 5).

We do not sell personal data and do not use it for advertising.

Who else handles it

These providers process data for us, only to run the service: Neon (the database), Vercel (the website and visit counts), Render or Oracle Cloud (the API servers), OpenRouter (the questions you ask the assistant and the context sent with them, only when you use it), Razorpay (payments) and GitHub (sign-in). Some of them store or process data outside India.

How long we keep it

  • Account data: while your account exists.
  • Run logs: 30 days.
  • Runs and their results: 30 days on the free plan, one year on a paid plan. Once a log or result is deleted, search no longer finds it.
  • Research telemetry: one year. Turning it off deletes yours at once.
  • Waitlist addresses: until the service launches and we have written to you, then deleted, or earlier if you ask.
  • Server logs: for the period our hosting providers keep request logs.

Your rights

Signed in, you can download a copy of your data and delete your account yourself, on the Your Data page under Settings. Deleting the account removes everything stored for it: your profile, tokens and the AI assistant’s data at once, your backup history within 24 hours. Backup archives stay in your own storage. Deleting a conversation with the AI assistant also deletes the investigations and tool runs behind it and their search index entries.

You can also ask us for a copy of your data, for corrections or for deletion, and name someone to act for you. Write to [REAL DATA REQUIRED: support email]; we answer within 30 days and complete a deletion within 30 days of the request.

Security

Connections use HTTPS. Sessions live in a cookie that scripts cannot read, access tokens are stored only as hashes, and OpenRouter keys are encrypted at rest.

Cookies

One session cookie keeps you signed in, and short-lived cookies protect the GitHub sign-in itself. There are no advertising or tracking cookies.

Children

The service is not meant for anyone under 18.

Changes

We post every change on this page and email account holders about material changes before they apply.

Grievance officer

Shardendu Mishra, [REAL DATA REQUIRED: support email], [REAL DATA REQUIRED: postal address].