Privacy

After each commit, the CLI sends four things:

• the commit message and hash;
• the list of changed file names (git show --stat);
• a scrubbed diff, capped at 16 KB;
• the repository name.

It does not send your whole repository, your git history, your branches, your remotes, or any file that was not part of the commit.

Scrubbing runs on your machine, not on our servers. Three things apply:

• A built-in path list. Changes to paths containing .env, secrets/, credentials, .pem, id_rsa and a dozen more are dropped from the diff. Matching is on substrings of the path.
• Content patterns. Known secret shapes (API keys, private key blocks, cloud credentials) are replaced with a redaction marker even when the file itself looks innocent.
• gitleaks, if you have it. When the gitleaks binary is on your machine, its findings are redacted too. If it is not installed, that layer simply does not run — the CLI warns you once and keeps going rather than silently pretending it scanned.

You can add your own patterns per repository with a .growthcommit/config file. An account-wide list is not available yet; it needs to run on your machine to be worth anything, and shipping only the settings screen for it would be a promise we could not keep.

Per repository, you can switch the diff off. From your next commit on, it is discarded the moment it arrives: never stored, never sent to the model. The analysis then runs on the commit message and the file names alone, which makes it more general — that is the trade, and it is yours to make.

You will find the switch under Settings → Repos once you have an account.. To stop the diff from leaving your machine at all, set send_diff: false in the repository's .growthcommit/config.

We are a small operation built on other people's infrastructure. Your data passes through these:

• Zhipu AI (GLM) — receives the commit message, file names and scrubbed diff to extract the concepts. This is the one that sees your code, and it is the one most services in this position do not name.
• Brave Search — receives the concept names to look for resources. It never receives your code or your identity.
• Neon — the Postgres database where everything is stored.
• Vercel — hosting for this site and the API.
• Inngest — runs the analysis jobs.
• Resend — sends your email, and the sign-in links.
• Sentry — error reports. It receives stack traces, not your diffs.

We do not sell data, we do not share it with advertisers, and we do not track opens or clicks in the emails we send you.

There is no admin screen in this product. No page exists, for anyone, that lists or opens another person's analyses. That is a fact about the code, and you are welcome to check it.

What does exist is ordinary database access — the credentials needed to run migrations, fix a broken job and keep the service alive. Those credentials can read anything in the database, including stored diffs. Any service of this kind has that, and most privacy pages phrase it in a way that suggests otherwise.

So: our commitment not to read your content is a stated policy, not a technical control. We would rather write that sentence than imply a guarantee we have not built. A separate read-only support account — usable only on a specific analysis, only when you ask us to look at it — is planned and does not exist yet.

If you would rather not have to take our word for it, that is exactly what the diff switch above is for. It is a control, not a promise.

Completed analyses are kept while your account is active. Analyses you delete, and commits replaced by an amend, are marked for removal and purged after 30 days. Failed analyses are kept 7 days.

To be precise about the current state: the automatic purge job ships alongside the beta. Until then, deletion marks your data as deleted and hides it everywhere, and the permanent removal is done on request.

Cancelling your account revokes every token immediately and starts a 30-day grace period, during which you can restore it yourself or download everything.

• Turn the diff off per repository, or pause a repository entirely.
• Delete an individual analysis, or a repository along with its analyses.
• Download everything as a zip, at any time, including while cancelling.
• Revoke any machine's token from Settings; it stops working immediately.
• Cancel your account, with 30 days to change your mind.

Changing the email address on the account is not self-service yet — it needs a verification flow we have not built. Ask us and we will do it by hand.