Privacy policy

Last updated 9 October 2026

This policy explains what personal data Verity collects, why, where it goes and how long it is kept. Verity is run by Michael Mather, of St. John's, Newfoundland and Labrador, Canada ("we", "us"). Michael Mather is responsible for how Verity handles personal data. Questions and requests go to privacy@veritypr.dev.

Who this policy covers

Verity is a tool for engineering teams. A team installs the Verity GitHub App on its GitHub organization or account (the "customer") and turns on session capture in its repositories. This policy covers:

people who sign in to veritypr.dev with GitHub;
developers whose Claude Code sessions are captured in a customer's repository;
visitors to veritypr.dev.

Our two roles

For session content and reports, we act for the customer. The customer decides to capture sessions in its repositories, sets how long they are kept and decides who can see them. In data protection terms, the customer is the controller and we are its processor. If you are a developer whose sessions are captured, the customer (usually your employer) is responsible for telling you and for answering your requests. We help them do that.
For account and sign-in data, we decide. For that data, we are the controller.

What we collect

Your GitHub user id and login, from GitHub sign-in. We don't receive your email address, name or password.
GitHub access tokens, so Verity can check which repositories and reports you may see. They are stored encrypted (AES-256-GCM).
A sign-in session, kept for 30 days unless you sign out first.

When sessions are captured

Capture is set up by the customer: its hooks are committed to the repository, so everyone working there can see that sessions are captured.

Transcripts of Claude Code sessions: prompts, the agent's replies, the commands it ran and their output, and the files it read or changed. Transcripts can contain personal data that developers type or that appears in code and output.
Before anything leaves the developer's machine, secrets are redacted (API keys, tokens, passwords and similar). We redact again on upload, and check again before any text reaches a model. Redaction finds known secret patterns. It doesn't remove all personal data.
Session metadata: ids, repository, branch, commit and times, and the GitHub account the session belongs to.
Pull request metadata from GitHub: repository, PR number and title, author, changed files and the diff, read through the GitHub App.

Reports

For each analysed pull request, Verity writes a report: the review brief, the results of the customer's rules, and excerpts from the session and the diff (flagged steps, command output, changed lines). Only people with access to the repository on GitHub can open a report.

When you visit the site

Our servers log each request: ids, counts, durations, error names and route templates. Logs contain no session content and no repository or user names. We don't use analytics, advertising or third-party scripts.

Cookies

We use only cookies that are strictly necessary for signing in:

Cookie	What it does	How long
`__Host-session`	Keeps you signed in	30 days, or until you sign out
`__Host-oauth`	Protects the GitHub sign-in against forgery	10 minutes

There is no cookie banner because we set no other cookies.

How we use data

To provide Verity: to analyse pull requests, post check runs and comments on GitHub, show reports and answer requests from MCP clients.
To run and secure the service: to find faults and abuse, and to enforce plan limits.
To contact you: only about your account or the service, when you write to us.

We don't sell personal data, don't use it for advertising and don't build profiles of developers.

The legal bases (for people in the EU, UK and similar regions):

The contract with the customer: for session content and reports.
Our legitimate interest in running a secure service: for account data and logs.

Models

To answer rule questions and write parts of the review brief, Verity sends redacted excerpts to AI model providers through OpenRouter, during analysis only.

Zero data retention is required: our OpenRouter account is set to use only providers that keep no copy, and every request asks for it.
No training: your data isn't used to train any model. We have no models of our own.

Subprocessors: the companies that host and run Verity. They are listed, with what each holds and where, at /legal/subprocessors.
GitHub: check runs and PR comments are posted to the customer's repository. They carry only the results of the customer's rules and text the customer wrote in its rules file. They never contain session excerpts.
When the law requires it: if a valid legal request requires it, we tell the customer first, unless the law forbids that.

Where data is kept

Verity runs in the United States. If you are outside the United States, your data is transferred there. For customers that need it, our data processing agreement covers international transfers.

On Team plans and up, a customer can keep transcripts in its own storage bucket instead of ours. Those transcripts then stay under the customer's control.

How long we keep it

Data	Kept for
Transcripts in our storage	30 days by default; the customer can set 7 to 180 days
Reports	90 days by default; the customer can set 7 to 365 days
Session index (ids, repository, branch, times; no content)	Until the reports that use it expire
Sign-in sessions	30 days
Server logs	30 days at most
GitHub user id and login	While you have an account, or until you ask us to delete them

When a customer uninstalls the GitHub App, we delete its transcripts from our storage.

Security

Encryption: transcripts and reports are encrypted at rest, and stored separately for each customer.
Encrypted connections: all traffic to Verity uses HTTPS.
Access: a report can only be opened by someone GitHub says can see the repository.

To report a vulnerability, see our security page.

Your rights

Depending on where you live, you can ask:

to see the personal data we hold about you;
to have it corrected or deleted;
to restrict or object to how we use it;
for a copy you can take elsewhere.
Account data: email privacy@veritypr.dev, and we answer within 30 days.
Captured sessions: ask the customer whose repository captured them. If you ask us, we pass your request to them.

You can also complain to the Office of the Privacy Commissioner of Canada, or to your local data protection authority.