Privacy Policy

Information used by the app

When you use SolarGlyph Copilot, the app processes account information and authentication handled by Supabase; conversations and repository selections saved to your account; and provider credentials and connection details that you choose to save or provide. Assistive commit sends the proposed file change and its summary to your configured AI provider for a separate safety assessment. The browser also stores some preferences and operational details locally, including your nickname, commit mode, last sign-in method and (when you opt in on the sign-in page) your email address, pinned conversations, a short list of recently used repositories, the files you pinned for each repository, and recent conversation audit summaries. No GitHub token is stored in your browser. The Agent tab temporarily caches your model list and the names of the repositories you shared with the app for up to two minutes to speed up workspace loading.

GitHub access. Copilot reaches GitHub through the SolarGlyph GitHub App, which you install on your own account or organization and which only sees the repositories you select. We store which GitHub account installed the app and its installation number (so we can tell the installation belongs to you), plus short-lived random values used to confirm the installation came from your signed-in session. For each action, our server asks GitHub for a temporary token limited to one repository and the permissions needed (reading files, creating commits and branches, opening pull requests); these tokens are cached in server memory for under an hour and are never written to the database or sent to your browser. Signing in with GitHub only confirms who you are: it does not give Copilot access to your repositories. If you connected GitHub in an earlier version, that older authorization stays encrypted on our server until you remove it in Settings. GitHub also sends our server signed notifications (webhooks) when the app is installed, removed or changed, or when someone pushes to a repository the app can reach; we use them only to refresh what Copilot sees and to forget an installation that was removed, and we do not store them. You can disconnect the app in Settings or uninstall it on GitHub at any time, which ends our access immediately.

How information is used and shared

Conversation messages and relevant repository content are sent to Tomdacat to generate responses. When you use GitHub features, our server sends repository requests to GitHub using temporary tokens issued to the SolarGlyph GitHub App for the repositories you chose. The names of the files you pin and the files Copilot reads for a conversation are included in what is sent to Tomdacat, along with a short map of the repository’s folders. Supabase provides authentication and data storage. These providers process information under their own terms and privacy policies. Do not submit secrets or information you are not authorized to share.

When the app is deployed on Vercel with Speed Insights available, Vercel may collect website performance measurements. Localhost development does not load the Speed Insights script.

Logs, storage, and security

Operational server logs include request identifiers, response status, provider name, and durations; the app is designed not to log request bodies, authorization headers, API keys, or repository file contents. Browser-local audit summaries can include repository paths and tool activity. Clear the browser's site data to remove locally stored preferences and summaries; account data and saved credentials are managed through the connected Supabase project.

No online service can guarantee absolute security. Use strong account credentials, grant only the permissions you need, and disconnect integrations you no longer use.

Retention and choices

Conversation and account data remain subject to the retention and deletion controls configured for the connected service. You can clear browser-local preferences through your browser settings, remove saved provider credentials in the app where available, disconnect or uninstall the GitHub App, change which repositories it can reach from GitHub’s installation settings, or request account deletion when that feature is configured.

Policy updates and contact

This policy may change as the app and its integrations evolve. Read our Terms and Conditions. For privacy questions, contact SolarGlyph Labs through the community support channel.