Privacy Policy
Version 1.3 · 24 September 2026
Who is responsible
AELaboratories is the data controller. support@borehole.dev.
The short version
- Reports contain no personal data. Authorship is stored as counts and ratios — "top author 160 of 257 commits", "40 of 56 authors have exactly one commit" — never as names or email addresses.
- We do not store your IP address for quota. It is hashed with a secret salt, because the only question we ask of it is whether it is the same subject as before.
- All of our own infrastructure is in the EU.
- We do not sell anything to anyone, and there is no advertising.
What we store, and why
| What | Why | Lawful basis | Kept |
|---|---|---|---|
| Your GitHub id, login, display name, email and avatar, if you sign in | To know who you are, to apply your allowance, and to show you what you bought | Contract | While the account exists |
| Session id, user agent and address | To keep you signed in and to spot session abuse | Legitimate interest | 30 days, then deleted |
| Collector tokens: the name you gave each one, its first characters, a hash of the token, and when it was created, last used and revoked | To accept bundles from your collector. The token itself is shown once and never stored | Contract | Until you delete the account |
| A salted hash of your address | Free-tier quota. Never the address itself | Legitimate interest | 30 days |
| Reports: findings, evidence pointers, bands, rejection log | The product. A report is about a repository, not a person | Legitimate interest (public) · Contract (private) | Indefinitely — a verification mark has to keep resolving |
| Order reference, amount, tier, email, Stripe identifiers, and the account you added the key to, if you did | To take payment, prove what you bought, and let the collector spend it | Contract, then legal obligation for tax records | As tax law requires |
| Anything you type into a form — assessment requests, rebuttals, ratings | To reply to you, and to publish a rebuttal beside the finding it answers | Consent | Until you ask us to remove it |
| A pseudonymous analytics id — a salted hash, never the raw address | To count how many people reach each step | Legitimate interest | As PostHog retains it |
What we deliberately do not store
- Your source code. A private repository never reaches us: the collector reads it on your own machine and sends facts about it. A public repository is cloned for its survey, and the copy is deleted when the survey ends, including when it fails. What survives is the report.
- The collector's bundle. We use it to produce your
report and then discard it. It is never attached to error reports.
Since collector 0.4.0 it also lists the dependencies your lockfiles pin
from public registries (name, version, ecosystem); packages from a
private registry, a git URL or a local path are left out on your
machine. Our server, not the collector, looks those names and versions
up in OSV, a public vulnerability database. OSV receives each package's
ecosystem, name and version and nothing else: no repository name, no
path, no code, and nothing about you. Since collector 0.5.0 the
collector also reads committed
.envfiles, only to find credentials in them: it sends where a credential-shaped value sits and its kind, never the value and no other line. - Contributor identities. Authorship is counted, not named. A report contains no email addresses.
- Card details. Payment happens on Stripe's pages. We never see a card number.
- Your collector token. We keep a hash of it, which is enough to recognise it and useless to anyone who takes it.
- Commit author names and email addresses. Authorship reaches a report only as counts and ratios. The collector hashes names and addresses on your machine before sending them. Those hashes are pseudonyms, not anonymous: anyone holding a bundle could test whether a guessed address belongs to an author. We use them only to count, and discard them with the bundle.
One exception, stated rather than hidden. Three checks quote a small amount of text as evidence: the text of up to five TODO-style comments, up to four commit subjects, and an unpinned dependency line. In each case the quoted text is the evidence, which is why it is kept by default — paraphrasing a TODO would be worthless. Whoever controls the repository can remove it from a report at any time, which rewrites what we store, so afterwards we do not hold it at all. The pointers stay, so the line can still be found.
Who else processes it
All of our own infrastructure runs in the EU.
| Processor | For | Where |
|---|---|---|
| Google Cloud | Hosting, database, scanning | europe-west1 (Belgium) |
| Stripe | Payments | United States and globally |
| GitHub | Sign-in, and metadata for public repositories | United States |
| OSV (Google Open Source Security) | Known-vulnerability lookups | United States |
| Resend | Transactional email | eu-west-1 (Ireland) |
| Sentry | Error reports | Germany |
| PostHog | Product analytics | EU cloud |
What each one receives, and which are optional.
Stripe and GitHub are US companies, so using them involves a transfer outside the EU under their standard contractual clauses. You cannot use the paid product without Stripe, or sign in without GitHub.
Error reports and analytics
Error reports are scrubbed before they leave the process, by key name and by value shape: access tokens, Stripe keys and clone tokens are removed rather than redacted after the fact. Analytics are server-side and identified by a salted hash, not by a cookie. Do Not Track is honoured. Session replay is off, and must never be enabled on a report page — a report can quote a private repository, and recording the screen would store that content a second time outside the boundary the architecture is built around.
Your rights
Under the GDPR you may ask for a copy of your data, ask us to correct it, ask us to delete it, object to processing based on legitimate interest, and complain to a supervisory authority.
Export and deletion are self-service, on your account page. The export is assembled by querying the database rather than from a list of what we believe we store, because such a list goes stale the first time a table is added and you would have no way to tell. For anything these do not cover, write to support@borehole.dev.
When an account is deleted: the account record is anonymised, sessions are deleted, collector tokens are deleted, keys are detached from the account, form submissions are removed, and a published rebuttal is anonymised rather than deleted — removing it would alter what a report said. Orders are kept where tax law requires, with the email address redacted once that period has passed. Reports are unaffected, because they contain no personal data.
Children
This is a tool for professionals. It is not directed at anyone under 16 and we do not knowingly collect their data.
Changes
A material change will appear here with a new version and date.
See also the Terms of Service.