Privacy Policy
Last updated: November 3, 2025
1. Information We Collect
1.1 GitHub OAuth Data
When you connect your GitHub account, we collect:
- GitHub username and email address
- Repository metadata (names, URLs, branch information)
- OAuth access token (encrypted with AES-256-GCM)
1.2 Code Metadata (Not Source Code)
We extract and store metadata from your codebase:
- File paths and structures
- Function and class names (symbols)
- Dependencies between files
- Commit history (author, date, message)
- Database schema information (if you provide database credentials)
Important: We do NOT store your source code. Only metadata extracted during indexing.
1.3 Usage Data
- Pages visited and features used
- AI queries and responses
- Performance metrics
- Error logs for debugging
2. How We Use Your Information
- Code Analysis: Build code graphs, discover features, enable AI-powered search and analysis
- Service Improvement: Monitor performance, fix bugs, improve features
- Communication: Send notifications about indexing progress, feature discoveries, system updates
- Security: Detect and prevent unauthorized access
3. Data Storage and Security
3.1 Security Measures
- GitHub tokens encrypted at rest with AES-256-GCM
- Multi-tenant architecture with company-level data isolation
- Temporary code cloning during indexing (deleted immediately after)
- Secure OAuth flow via NextAuth v5
- PostgreSQL with parameterized queries (SQL injection protection)
3.2 Data Retention
- Code metadata: Retained while your workspace is active
- AI conversation history: Retained for 90 days
- Audit logs: Retained for 1 year
- Deleted workspace data: Permanently removed within 30 days
4. Third-Party Services
We use the following third-party services:
- GitHub: OAuth authentication and repository access
- Anthropic (Claude AI): AI-powered code analysis and feature discovery
- Google (Gemini AI): Alternative AI provider for analysis
- Amplitude: Anonymous usage analytics
Your code metadata may be sent to AI providers for analysis. We use enterprise API tiers with data protection agreements.
5. Your Rights
You have the right to:
- Access your data at any time through the dashboard
- Delete workspaces and projects (removes all associated data)
- Disconnect GitHub integration (revokes access token)
- Request complete account deletion (contact support)
- Export your data (available via API)
6. Cookies and Tracking
We use cookies for:
- Session management (authentication cookies)
- Security (CSRF protection)
- Analytics (Amplitude tracking with anonymous user IDs)
7. Data Sharing
We DO NOT sell or share your data with third parties, except:
- AI providers (Claude/Gemini) for code analysis purposes only
- When required by law or legal process
- To protect our rights or prevent fraud
8. Children's Privacy
Boostr is not intended for users under 18. We do not knowingly collect information from children.
9. Changes to This Policy
We may update this privacy policy from time to time. Significant changes will be announced via email and dashboard notifications.