Privacy Policy

1. Scope of this policy

Actions Cost Guard ("the Service") is operated by Lin HaiSheng (林海昇) ("we", "us", "our"). For any question about these documents, email [email protected].

This policy explains what data the Service reads from GitHub, what we store, how long we keep it, and the controls you have. It applies to the public website, the free public-repository scan, the connected-repository monitoring features, and the emails we send.

2. What we read from GitHub

We access GitHub data only after you install our GitHub App and explicitly select which repositories to authorise. Depending on the feature you use, we read:

• Repository metadata (repository ID, name, visibility, default branch).
• GitHub Actions run and job metadata, including job status, start and end times, runner type, attempt and re-run counts.
• Workflow definition files located at .github/workflows/*.yml and .github/workflows/*.yaml.
• The email address that GitHub reports as verified for your account, and only when you enable email notifications.

3. What we never access

The Service is strictly read-only. We do not read your source code outside workflow definition files, and we never access repository secrets, environment secrets, tokens or full job logs.

We do not write to your repository, do not modify YAML, do not open pull requests and do not trigger or cancel workflow runs.

4. Free public-repository scans (no account)

You can scan a public repository without signing in. For these scans we analyse the last 30 days of public Actions metadata and cache the result for up to 24 hours, after which the cached result is deleted.

To protect the service we limit public scans to 50 per source IP address per natural UTC day. The limit is applied identically whether or not you are signed in. Repeating a scan of the same repository within 24 hours is served from the cache described above and does not count against that limit.

Only a non-reversible keyed hash of the source address is retained — never the address itself — and only for the current and the previous two UTC days. That key is used only for this technical rate limiting.

5. Pre-checkout compatibility check

Before you pay, we run a compatibility check that reads only the minimum needed to confirm the repository can be analysed: repository ID, visibility, whether at least one workflow exists, a sample of runner types, and permission status.

These temporary results are discarded within 1 hour, or immediately on cancellation or failure. If you cancel checkout, we keep only the selected repository ID and name for 24 hours so the wizard can resume. No private cost analysis is produced or retained at this stage.

6. What we store for accounts

For a signed-in account we store the data needed to run and bill the Service:

• GitHub identity returned by OAuth: numeric user ID, login and avatar URL.
• The GitHub App installation reference and the list of repositories you selected for monitoring.
• Derived analysis results: estimated cost aggregates per job group, baseline and anomaly state, data coverage ratios and evidence links.
• Your settings: notification preferences, timezone, verified notification email and subscription status.
• Subscription and invoice status mirrored from our payment provider. We never receive or store full payment card data; card details are entered on the payment provider's hosted checkout.

7. How long we keep data

Retention is tied to the lifecycle of your subscription and repositories:

• First sync backfills up to 90 days of history; an active subscription keeps the most recent 180 days of aggregated results.
• If a subscription is cancelled, access continues to the end of the paid period, followed by a 7-day read-only grace period. All historical analysis data is deleted 30 days after the subscription expires.
• If a payment fails, the provider retries for 7 days. If payment is not recovered, the subscription is marked expired and the same 30-day deletion countdown starts.
• If you uninstall the GitHub App, or every selected repository loses access, we stop pulling data immediately and allow a 7-day reconnection window. Historical analysis data is deleted 30 days after the uninstall or loss of access.
• If you remove a single repository, its history is retained for 30 days and then deleted. Re-adding the repository within 30 days restores the previous history; you can also delete it immediately.
• If you delete analysis data while keeping a subscription, nothing is rebuilt until you explicitly start analysis again.

8. Account deletion

Deleting your account requires a second confirmation. On deletion we immediately revoke tokens and close access, and we cancel any active subscription with the payment provider so no further charges occur.

Account and analysis data in the production database, caches and object storage is deleted within 7 days. Backup copies expire within a 30-day rotation cycle. Deletion is executed as an idempotent asynchronous job that writes an audit event.

Payment and invoice records are kept by the payment provider and by us for the minimum period required by payment and tax rules, and are kept separate from your product analysis identity.

9. Cookies and local storage

We set one session cookie, acg_session. It is HTTP-only, SameSite=Lax, and is used only to keep you signed in. It holds an opaque session token rather than your identity. The session is extended each time you use it, it expires after 14 days without use, and it can never outlive a hard ceiling of 30 days. Its default lifetime is 7 days, unless you choose the 30-day "remember me" option when signing in. We do not set advertising or cross-site tracking cookies.

10. Analytics

We use aggregate, privacy-oriented product analytics to understand which pages and flows are used. These measurements are not used to build advertising profiles and are not shared with advertising networks.

11. Service providers

We rely on a small number of processors to operate the Service. Each receives only the data it needs for its function:

• GitHub — source of repository and Actions metadata, and the sign-in provider.
• Creem — Merchant of Record. Creem sells the subscription to you on our behalf, processes payment, and handles invoicing and sales tax.
• Resend — delivery of transactional and notification email.
• Railway — application hosting and managed PostgreSQL database.
• Cloudflare — DNS and inbound email routing for our support address.
• Umami — aggregate product analytics.

12. Your controls

Everything below is available in Settings:

• Export the basic data associated with your account.
• Delete your analysis data without closing your account.
• Delete your account and all associated data.
• Disconnect the GitHub App at any time, which stops all further data collection.
• Turn the weekly digest and the high-priority anomaly email on or off independently. The one-time first-analysis email is transactional and cannot be unsubscribed.

13. Children

The Service is a developer tool and is not directed to children. We do not knowingly collect data from anyone under 16.

14. Changes to this policy

If we make a material change to how we handle data, we will update this page and adjust the date above. Continued use after an update means you accept the revised policy.

15. Contact

Questions, requests and data-deletion enquiries: [email protected].