Privacy Policy

This policy describes what Anywaye collects and how we use it. Read it before you connect a repository. See our Terms of Service for the full agreement.

What we access

When you connect a repository, we read its contents and its dependency lockfiles. On GitHub, we use the Anywaye GitHub App with read contents and write pull requests permissions. On Anygit, our own git host, we use a key scoped to your repository.

What we store

We store a dependency inventory for each repository. The inventory lists package names and versions. We also store vulnerability check results, CVE match records, and pull request metadata. For automated fixes, we store an agent run transcript: a redacted record of the model's messages, tool calls, and token usage for that fix. Transcripts do not contain your source code; file contents are never written to them, and any secret values are redacted before storage. We do not store your source code in our database.

Your code on dev boxes

We clone a repository into an isolated dev box to prepare a fix. The clone lives on that dev box while the fix runs. We delete the dev box and its disk when you disconnect the repository or delete your account. We do not share the clone with other users.

Anygit

Anygit is our own git host. Repositories, organizations, and files that you store on Anygit live there under your account. Anygit mirrors the visibility that you set on GitHub when a repository is mirrored. We keep the mirror so that we can offer repository features on Anywaye, such as pull requests and checks. You can delete a repository on Anygit at any time.

Sign-in providers

You can sign in with GitHub or Google. When you do, that provider shares your name, email address, and profile picture with us so we can create and identify your Anywaye account. We use this information only for authentication and account management. We do not share it with third parties, and we do not use it for advertising. You can disconnect a provider at any time from your account settings.

Third parties

We send package names and versions to OSV and cve.now to find CVEs. We do not send your source code to these services. For code level fixes, we may send the relevant code snippet to an AI model provider to create PRs. We use Stripe for billing. We do not sell your data.

Retention

Dependency inventories, vulnerability check history, and agent run transcripts are retained indefinitely while your account is active, so we can measure and improve the service over time. Access tokens are revoked when you disconnect a repository. We delete all of your data, including transcripts, when you delete your account.

Your rights

You can disconnect a repository at any time. You can delete your account at any time. You can ask us for a copy of your data. Contact us on Slack for any request.

Changes to this policy

We can change this policy. We will tell you about material changes.

Contact

Questions? Join us on Slack.