Skip to content

docs(legal): say what GitHub tells app.fctl.sh about pull requests #36

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kalaspuff merged 1 commit into from
Oct 21, 2026
Merged

docs(legal): say what GitHub tells app.fctl.sh about pull requests #36

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 13 additions & 5 deletions legal/privacy.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
---
updated: 2026-10-20
updated: 2026-10-21
description: What personal data hyperstructure collects on fctl.sh and app.fctl.sh, why, who receives it, how long it is kept, and your rights.
---

Expand Down Expand Up @@ -123,8 +123,9 @@ account, you can ask for early access on its sign-in page.
- **Projects and sessions**: project names, descriptions and settings,
the workspace they belong to, linked GitHub repositories, members and
their roles, and the secrets you add (encrypted). For each session: its
task, status, branch and pull requests, who started it and who it is
shared with, and its transcript, which records everything the agent and
task, status, branch and pull requests (with their state, when it changed
and how many of their checks passed, as GitHub says), who started it and
who it is shared with, and its transcript, which records everything the agent and
the people in the session said and did. Transcripts include the agent's
tool calls and their results, so they can contain your source code, file
contents and command output.
Expand All @@ -143,7 +144,13 @@ account, you can ask for early access on its sign-in page.
- **GitHub**: the repositories you link through our GitHub App, and the
branches and pull requests agents create. We never sign you in to GitHub;
agents work with short-lived tokens limited to their project's
repositories, within the GitHub accounts its workspace uses.
repositories, within the GitHub accounts its workspace uses. GitHub also
tells us, through our app's webhook, when pull requests and their checks
change in the repositories the app is installed on. For the pull requests
sessions list, we then ask GitHub about them and keep their title and
state, when it changed, their latest commit and how many of their checks
passed, failed or haven't finished; the rest of what GitHub sends us we
don't keep.
- **Published screenshots**, in projects whose maintainers turn them on
(they are off until an admin of app.fctl.sh allows them and a project
turns them on): the images agents publish so that pull requests can show
Expand Down Expand Up @@ -229,7 +236,8 @@ processing terms:
for your browser, so the push service learns when we send one, to which
subscription and how big it is, but not what it says.
- **GitHub**, for the repositories you link: agents push branches and open
pull requests there. If you set a commit email, the commits agents make
pull requests there, and we ask GitHub what became of the pull requests
sessions list. If you set a commit email, the commits agents make
in the sessions you start end with a `Co-authored-by` line that has your
name and that address, unless the project's maintainers turn that off.
Everyone who can read the repository sees it, which is everyone for a
Expand Down