Data, retention and deletion

This page is the practical side. The Privacy Policy is the full account of what Graphide keeps and why.

What Graphide keeps

Product	What	Details
Your account	Your user ID and email address; with GitHub sign-in, your GitHub user name and ID	Accounts and access
Graphide review	Each review and its findings, the pull request’s title, description and author, and the repository’s graph	Review security
Graphide CI	Records of each job, test results, environments prepared for your jobs, agents’ work, and agent signals	CI security
Both	GitHub’s webhook deliveries, and our servers’ logs of each request, with the address it came from	Below

All of it is kept in the United States.

How long

What	Kept
Reviews and their findings	While the GitHub App is installed on the repository
Records of each review’s progress on a pull request	90 days
GitHub’s webhook deliveries	14 days after they arrive, once handled
CI machines and review containers, with any clone of your code on them	Deleted when the job or the review ends
Actions caches of the runs Graphide makes before your jobs move	Deleted after 7 days unused
Test results that gr ci run sends to the Graphide API	90 days
Records of the jobs Graphide CI ran	90 days
Each test’s verdict in your own CI runs, read from their logs	30 days
Graphide CI’s events about your jobs, with their test results	400 days
The work of Graphide CI’s agents: proposals, proofs, transcripts and the evidence they work from	180 days
Agents’ decision records, and the certificates behind an adopted change, which hold no code	1 year
Agent signals	30 days
The Graphide API’s server logs	30 days
Your account	Until you ask us to delete it

After you uninstall the GitHub App, or remove a repository from it, we delete that repository’s data by hand within 30 days of the uninstall, or at once if you ask.

Graphide CI’s database keeps Azure’s automatic backups for 35 days.

What Graphide never collects

• No telemetry. No usage data, no crash reports and no screen recordings from your machine. The one exception is agent signals, which say when your coding agents start work and are about to push. They send the repository, branch and commit and the kind of event, never your code, your prompts or your agents’ conversations. If your agent asks Graphide to test a commit, that commit is sent for the test. They are kept 30 days, and you can turn them off.
• No website analytics. graphide.com runs no analytics, sets no analytics cookies and makes no session recordings.
• No passwords and no card details. Supabase runs sign-in, and Stripe takes payment.

When the Graphide API hits an error, the error report goes to Sentry, with credentials, the Authorization header and cookies taken out. A report can include a repository name or a file path.

Graphide never trains an AI model on your code or data, and never sells it.

Deleting your data

To	Do this
Stop new reviews of a repository	Turn its switch off on your dashboard. Its past reviews are kept.
End a CI machine or review container	Nothing: each is deleted when its job or review ends.
Stop agent signals	The switch on your dashboard, GRAPHIDE_SIGNALS=off on one machine, or a .graphide/signals-off file in one repository.
Have a repository’s data deleted	Uninstall the GitHub App, or remove the repository from it. We delete its data by hand within 30 days, or at once if you write to privacy@graphide.com.
Have your whole account deleted	Write to privacy@graphide.com from the address on the account.

Section 9 of the Privacy Policy is the binding version.