Privacy
Your data
What this app sends to the AI model, what it stores, where and for how long.
Last reviewed on 2026-10-04.
What goes to the AI model
The AI features run on Groq. Only these features send code, and only when you use them:
- Health report
- Up to 24 pieces of your code (19,000 characters in total at most), plus the project name and framework. When the code has not changed since the last analysis, the earlier review is reused and nothing is sent.
- Chat
- Your question, the conversation so far and the 8 pieces of code most related to the question.
- Explain a file
- Your question and the file, cut at 12,000 characters.
Code is sent as it is. Secrets written in the code (API keys, passwords) are not removed before it is sent, so remove them before importing a project. Secrets are only hidden on public share links.
Zero Data Retention is on for this app's Groq organization (since 2026-10-04): Groq does not keep the input or output of requests, not even the up to 30 days it otherwise may keep for reliability and abuse monitoring. Read Groq's data policy.
What we store and for how long
| Data | Where | Kept until |
|---|---|---|
| Account: name, email, password (bcrypt hash only), sign-in provider | Neon Postgres | The account is deleted |
| Project files, code pieces and their vectors (embeddings) | Neon Postgres | You delete the project, or 90 days without use (opening the project or analyzing it counts as use). The project and its report stay; analyzing again brings the code back. |
| Reports and the AI review | Neon Postgres | You delete the project |
| Uploaded ZIP file | Neon Object Storage (private bucket) | Deleted right after import; a leftover upload is removed by a daily cleanup |
| GitHub App installation id and account name (no token: a read-only token lasting 1 hour is created for each use) | Neon Postgres | You disconnect GitHub in Settings |
| Report share links (only a hash of the link) | Neon Postgres | Revoked, expired or the project is deleted |
| AI usage: feature, model, token counts, time and cost (never the content) | Neon Postgres | The account is deleted |
| Plan and Stripe customer/subscription ids (no card data) | Neon Postgres | The account is deleted |
Services that handle your data
- Groq
- Runs the AI model (see above). Receives code only for the features listed.
- Neon
- Database and file storage, in AWS US East (N. Virginia).
- Vercel
- Hosts the app and runs the analysis in the US East region. Analysis jobs carry only ids, never code.
- Sentry
- Error and performance monitoring. Personal data and secrets are removed before anything is sent; no code is sent.
- Stripe
- Payments. Card details go straight to Stripe and never reach this app.
- GitHub
- Source of the repositories you choose. Access is through the codedriven GitHub App: read-only, only on the repositories you pick, and it can never write to them.
- Hugging Face
- Only the embedding model is downloaded from it. Embeddings are computed on our own servers, so your code is not sent there.
Deleting your data
- Deleting a project removes its files, code pieces, vectors, reports and share links at once.
- Code you stop using is removed on its own: 90 days after you last opened or analyzed a project, a daily job deletes its files, code pieces and vectors.
- Disconnecting GitHub in Settings removes the codedriven GitHub App from your account (unless someone else in your organization still uses it) and deletes what was stored. Deleting the account does the same.
- Deleting your account in Settings removes all of the above at once and cancels your subscription. Stripe keeps its own payment records, as the law requires.