Privacy
What GitGraf reads, and what it keeps
Last updated 7 September 2026.
GitGraf reads your repository and tells you what is wrong with it. That means it is handed access to source code, which is usually the most sensitive thing a company owns. This page says exactly what happens to it, in the order that matters: what is never stored, what is stored, and who else can see any of it.
GitGraf does not store your source code. A scan reads files from GitHub, holds them in memory while it works, and writes down only what it concluded: file paths, line numbers, dependency names and versions, and short excerpts of the specific lines a finding is about. The files themselves are not written to any database and not kept after the scan ends.
Who we are
GitGraf is operated by the company behind gitgraf.io. For anything on this page, including a request to see or delete your data, write to hello@gitgraf.com and a person will answer.
What GitGraf stores
Your account
- Your email address, and your name and avatar if your GitHub or Google account provides them.
- Which plan you are on.
- Which projects you belong to.
Your projects
- The full name of each repository, such as
your-org/your-app, and the GitHub App installation that covers it. - Branch names, pull request numbers and titles, commit SHAs, and the results of checks and deployments that GitHub and Vercel report.
- Credentials for the connectors you choose to attach, held encrypted and used only to make the requests those connectors are for.
What a scan concludes
- A map of your application: the names of features, code areas and services, and how they connect.
- An inventory of your dependencies, taken from your lockfile: package names and installed versions.
- Findings, each holding the file paths and line numbers it concerns, and a short excerpt of the matched line, capped at one hundred characters.
What GitGraf never stores
- File contents. Read during a scan, held in memory, never written down.
- The value of a credential it finds. When GitGraf reports a key committed to your repository, the finding records where it is and what kind of key it appears to be. It never records the key itself, not even a prefix of it.
- Anything from a repository you did not select. The GitHub App only sees what you grant it.
What GitGraf can do on GitHub
The GitHub App is read-only. Its permissions are checks, contents, metadata, pull requests and statuses, all read. It cannot push a commit, open or merge a pull request, change a setting or delete anything, because it was never granted the permission to do so. When GitGraf scans one repository it now asks GitHub for a token limited to that repository alone, valid for one hour.
Who else sees any of it
GitGraf uses a small number of other companies to run. Each one is listed here with what actually reaches it.
| GitHub | Where your repository already is. GitGraf reads from it and receives webhooks about it. |
|---|---|
| Supabase | Hosts the database holding everything described above, and handles sign-in. |
| Vercel | Hosts the GitGraf application itself. If you connect Vercel as a project connector, GitGraf also reads your deployments from it. |
| OSV.dev | The open advisory database. GitGraf sends package names and version numbers to ask whether an advisory exists. Nothing identifies you or your repository. |
| npm registry | Asked for the latest published version of a package, by name only. |
| Contabo | Hosts the server that runs Cloud QA on the Pro plan. It receives the preview URL of a branch and visits it in a browser. |
Nothing is sold, and nothing is shared with anyone for advertising. There is no advertising in this product.
Cookies and tracking
The GitGraf application sets two kinds of cookie: the session cookie that keeps you signed in, and one small preference cookie remembering which project you last looked at. There is no analytics, no tracking pixel and no third-party script on the GitGraf marketing site or in the application.
How long it is kept
Until you remove it. Deleting a project deletes its map, its findings, its branch history and its connector credentials. Deleting your account removes your profile and your memberships. Nothing is currently deleted automatically on a schedule; if that changes we will say so on this page and on the plans page before it does.
Your rights
You can ask what GitGraf holds about you, ask for a copy of it, ask for it to be corrected, or ask for it to be deleted. Write to hello@gitgraf.com. You can also remove most of it yourself at any time by deleting the project, and you can revoke GitGraf's access to your code entirely from GitHub, under Settings, Applications, without asking us at all.
Changes
If this page changes in a way that affects what GitGraf does with your code, the change will be described here with a new date at the top, and anyone with an account will be told.