Privacy Policy
How DevSummary collects, uses, shares, and protects data — including the GitHub repository activity we read to generate engineering briefs.
Last updated
DevSummary (“DevSummary”, “we”, “us”) is operated by FrostBtye Labs LLP, Marwari College, Kishanganj, Bihar 855117, India. This policy explains what we collect when you use the DevSummary website and application (the “Service”), why we collect it, who we share it with, and the choices you have.
If you connect DevSummary to a GitHub organization, you are asking us to read your repository activity. That data is the core of the Service, so we describe it in detail below.
Summary
- We read commit metadata, commit messages, and code diffs from the repositories you explicitly authorize, and use them to generate plain-English briefs.
- We send those briefs only to the email addresses and Slack channels you configure.
- We do not sell personal data, and we do not use your code or commit content to train our own models.
- Access tokens for GitHub and Slack are encrypted at rest with AES-256-GCM.
- You can disconnect the GitHub App and delete your organization’s data at any time.
Data we collect
Account data
When you sign up we store your name, email address, hashed password (if you use email and password sign-in), and session records. If you sign in with Google or a one-time email code, we store the identifiers the provider returns instead of a password. We also store your organization name, membership, and role (admin or member).
GitHub data
After an org admin installs the DevSummary GitHub App, we store, for the repositories granted to the installation:
- repository names, descriptions, visibility, and default branch;
- collaborator usernames, display names, avatars, and their repository access;
- commits: SHA, author and committer name/email/date, message, branch, parent SHAs, and per-file change statistics;
- the code diffs attached to those commits (truncated for analysis);
- webhook delivery records used to de-duplicate and retry ingestion;
- the encrypted installation access token.
We request the narrowest GitHub App permissions the Service needs. We never write to your repositories, and we never open pull requests, issues, or comments on your behalf.
Slack data
If you connect Slack, we store your workspace and team identifiers, the channel you select for delivery, and an encrypted bot token used solely to post briefs.
Generated content
We store the briefs we generate — title, summary, per-commit analyses (type, summary, changes), the commits included in each brief, delivery status, and token counts used for cost accounting.
Website and waitlist data
If you join the waitlist we store the email address you submit. Our marketing site is statically hosted and serves no advertising or cross-site tracking scripts. It does use Google Analytics, but only after you agree to it: see Cookies below. Our hosting and infrastructure providers process standard server logs (IP address, user agent, requested URL, timestamp) for security and reliability.
Cookies
Nothing is stored on your device for analytics until you agree to it.
We use Google Analytics 4 (property G-PHG60E5RNW) on our marketing site to
count visits and see which pages bring people here. It sets the _ga and
_ga_* cookies, which last up to two years.
Google Consent Mode v2 is configured so that ad storage, ad user data, ad personalisation, and analytics storage all start denied for every visitor, wherever you are. Analytics runs only after you press Accept on the cookie card. If you decline, or ignore it, no analytics cookie is ever written.
We run no advertising or remarketing tags, do no cross-site tracking, and do not sell personal data.
Two things are stored in your browser without asking, because the site cannot work as intended without them. Neither is a cookie, neither leaves your browser, and neither is used to identify you:
| Key | Purpose |
|---|---|
theme | Remembers whether you chose the light or dark appearance |
cookie-consent | Remembers the choice you made on the cookie card |
You can change your mind at any time using the Cookie settings link in the site footer. Turning analytics off there stops any further collection; you can also clear the cookies through your browser.
How we use data
| Purpose | Data used |
|---|---|
| Generate briefs | Commits, diffs, collaborators, repositories, projects, teams |
| Deliver briefs | Email addresses, Slack channel and token |
| Authenticate you | Account data, sessions |
| Operate and secure the Service | Logs, webhook records, error reports |
| Bill and forecast cost | Token counts, usage volume |
| Support and service email | Account data, your messages to us |
We rely on the following legal bases where the GDPR applies: performance of a contract (operating the Service), legitimate interests (security, abuse prevention, product reliability), and consent (waitlist and marketing email, which you can withdraw at any time).
AI processing
Commit messages and diffs are sent to OpenAI to classify each commit and to draft the brief text. We use OpenAI’s API under terms that do not permit training on submitted data. Diffs are truncated before submission (currently up to 60,000 characters per commit), and prompts are capped in size.
Do not commit secrets, credentials, or personal data you do not want processed into repositories you connect to DevSummary. Commit content is processed as-is.
Briefs are machine-generated summaries. They can omit or misstate details and should not be treated as an authoritative record of engineering work.
Service providers
We share data only with providers that process it on our behalf:
| Provider | Purpose | Data shared |
|---|---|---|
| GitHub | Source of repository activity | Installation and API requests |
| OpenAI | Commit analysis and brief generation | Commit messages, diffs, analysis text |
| Resend | Transactional and brief email | Recipient addresses, email content |
| Slack | Brief delivery to channels | Channel ID, brief content |
| Optional OAuth sign-in; website analytics once you consent | Authentication identifiers; page views and referrers | |
| Cloudflare | Marketing site hosting and CDN | Request metadata |
| Our infrastructure and database hosts | Running the Service | All stored data |
We also disclose data when required by law, to protect our rights or user safety, or as part of a merger or acquisition — in which case this policy continues to apply until you are given notice of a replacement.
We do not sell personal information and do not share it for cross-context behavioral advertising.
International transfers
Our providers may process data outside your country, including in the United States. Where required, transfers rely on the European Commission’s Standard Contractual Clauses or an equivalent mechanism.
Retention
- Commits, diffs, analyses, and briefs are retained while your organization is active, so historical briefs remain viewable.
- Uninstalling the GitHub App stops ingestion immediately. Existing stored data is deleted within 30 days of a deletion request, or up to 90 days if it must be removed from backups.
- Account and audit records may be retained where a legal or accounting obligation requires it.
- Waitlist addresses are deleted on request or when the waitlist closes.
Security
Access tokens are encrypted at rest with AES-256-GCM. Passwords are hashed and never stored in plaintext. Transport is TLS-only. Access to production data is limited to personnel who need it. Every API request is scoped to a single organization and role-checked.
No system is perfectly secure. If you believe you have found a vulnerability, email support@devsummary.com and we will respond promptly.
Your rights
Depending on where you live, you may have the right to access, correct, export, delete, or restrict processing of your personal data, to object to processing, and to withdraw consent. California residents may additionally request disclosure of the categories of data collected and shared, and may not be discriminated against for exercising these rights.
Email support@devsummary.com to make a request. We verify requests against your account and respond within the period required by applicable law. You may also lodge a complaint with your local supervisory authority.
Note that commit content belongs to the connected GitHub organization. If you are an individual contributor, direct deletion requests concerning repository activity to that organization’s admin, who controls the connection; we will assist them as a processor.
Controller and processor roles
For account and website data, we act as controller. For repository, commit, and brief data belonging to a connected organization, we act as a processor on that organization’s instructions. Organizations needing a data processing agreement can request one at support@devsummary.com.
Children
The Service is not directed to anyone under 16, and we do not knowingly collect their data.
Changes
We will update this page and its “last updated” date when this policy changes. Material changes will be announced by email or in the application before they take effect.
Contact
Privacy questions, legal notices, and security reports: support@devsummary.com
FrostBtye Labs LLP, Marwari College, Kishanganj, Bihar 855117, India
See also our Terms of Service.