privacy policy

the short version

• We collect only what we need to run the product.
• We never sell your data — ever.
• We never use your subscribers’ email addresses for our own marketing.
• You can delete everything, anytime, instantly.
• OAuth tokens are encrypted at the application layer before storage.
• AI-generated posts are created from commit messages only — your code never leaves your server.
• We use a small number of trusted third-party services — all listed below.

how Vernettic AI works

When you push a commit to GitHub, Vernettic extracts only metadata — the commit message text, file names, and line count delta. No code content, no diffs, no function names.

This metadata is sent to Groq (an AI inference provider running the Llama 3 language model) to generate your social posts and weekly digest. Groq receives only commit messages and file paths — never your code, never personal data about you or your users.

Groq processes your data under their own privacy policy and does not use your data to train their models. You can review Groq’s privacy policy at groq.com/privacy-policy.

The AI assistant inside your Vernettic dashboard (“Vera”) is also powered by Groq. Vera only receives messages you send directly to it — your app context (name, handle, recent post count) and your typed question. No other user data is sent.

third-party services

Every service that touches your data is listed here. Nothing else.

what we collect

Account data: your email address and display name. Used to log you in and send digests. Never sold.

OAuth tokens: encrypted with AES-256-GCM before storage. Even a database breach would not expose usable tokens. Deleted immediately when you disconnect a platform.

Commit metadata: commit message text, file paths (names only — never contents), line count delta, timestamp. Stored for up to 12 months or until you delete your account.

Subscriber emails: encrypted at rest. Used only to send your digest. We never contact your subscribers for our own purposes. Deleted immediately when you delete your account.

Roadmap votes: IP addresses are hashed with HMAC-SHA256 before storage. Raw IP addresses are never stored.

what we never do

• Sell your data to any third party — ever.
• Use your data for advertising.
• Send your code content to any AI service.
• Email your subscribers without your instruction.
• Access your private GitHub repositories without explicit opt-in.
• Store raw IP addresses anywhere.
• Include your data in AI training datasets without explicit opt-in consent.

your rights

Regardless of where you are, you can:

• Delete your account — all data deleted immediately and permanently from your account settings.
• Export your data — download your subscriber list, digest history, and roadmap anytime.
• Disconnect integrations — tokens deleted immediately.
• Turn off the mention scanner — disable it entirely in settings.

EU/UK users have additional GDPR rights (erasure, portability, restriction, objection). California users have CCPA rights. Email privacy@vernettic.com and we’ll respond within 30 days.

data security

• All data encrypted at rest (AES-256) and in transit (TLS 1.2+).
• OAuth tokens additionally encrypted at application layer before touching the database.
• Row Level Security on every database table — users can only access their own data.
• Passwords hashed with bcrypt — we cannot retrieve your password.
• In the event of a breach, we will notify affected users within 72 hours.

cookies

Vernettic uses only the cookies strictly necessary to run the service. We do not use advertising cookies, tracking cookies, or third-party analytics cookies, and we do not track you across other websites. Because these cookies are essential, no consent banner is required.

• vt_session — keeps you logged in. Expires after 30 days.
• vt_theme — remembers your dark/light mode preference. Expires after 1 year.
• vt_csrf — security, prevents cross-site request forgery. Cleared when your session ends.

contact

Questions, data requests, or concerns:
privacy@vernettic.com

We aim to respond within 72 hours.