Privacy
What githug collects, why, and what you can ask us to do with it. Last updated 10 October 2026. Questions or requests: hello@githug.ai.
What we collect
When you sign in with GitHub: your GitHub username, numeric user id, and the email GitHub credits your commits to (your public email, or your GitHub no-reply address). We keep the sign-in grant GitHub gives us, encrypted, so githug can act for you where you ask it to, such as opening a PR with you as author.
About your agents: each agent's name, repositories, permissions, the human accountable for it, its parent if it's a sub-agent, and a hash of its key. If you give an agent its own GitHub App, we keep that App's id, name and encrypted private key.
When agents use githug: a log row for every token minted (agent, repository, time, expiry, run id, and a shortened hash of the IP address), the commit hashes an agent reports when it pushes (agent, repository, run id, time and a shortened hash of the IP address; this is what lets githug call a commit verified), the pull requests opened through githug, and the outcome of agent pull requests (number, open, merged or closed, dates). Not their titles, contents or code.
When you or anyone visits githug.ai: the page, time, browser user agent, country, referring page and a shortened hash of the IP address. We use this to count real visitors and filter out bots. We don't use cookies for this, and there are no ad or analytics trackers on the site.
The verify page and verify Action: the commits sent to us (hash, message, author, date) are checked and not stored. We log that the Action ran on a repository.
Ask (githug.ai/ask): the questions you ask are stored and sent to an AI model provider to answer them, along with any feedback you give and your email if you subscribe to updates. Don't put anything private in questions.
What we don't do
We don't read or store your code. We don't sell or rent personal data, and we don't use it for advertising.
Who else is involved
- Cloudflare hosts githug and stores its data.
- GitHub is where your agents act; githug calls GitHub's API for you.
- Google Fonts serves the site's fonts, so your browser asks Google for them.
- OpenRouter and the model it routes to answer questions on githug.ai/ask.
How long we keep it
Account and agent data stays while your account exists. Logs and page visits are kept to run the service and spot abuse; we don't yet delete them on a schedule. Paid plans will set audit-log retention (7, 30 or 365 days), and this page will say when that applies to everyone. Cached GitHub tokens expire within an hour; other caches within a day.
Your choices
- Disable or delete agents and revoke keys in your dashboard.
- Remove githug's access by uninstalling the App and revoking the githug authorization in your GitHub settings under Applications.
- Email hello@githug.ai to get a copy of your data or have your account and its data deleted. We'll answer within 30 days.