Commitments, not marketing
Data handling
src/research/cloudflare/shadow-erasure.ts, verified against a
real SQLite-backed test suite, deployed 2026-09-04). An ad-hoc deletion request outside those two
triggers - "delete my repository's data now, without uninstalling" - is still handled by hand rather
than through a self-service form; that was never a different promise, just a slower path to the same
result.
What DiffCI can see
The DiffCI Shadow GitHub App requests exactly four permissions, all read-only: metadata, contents, Actions, and checks. It has no write permission of any kind. It cannot push, comment, label, open or close anything, change a check status, cancel a workflow, or alter a branch.
That is a structural property of the installation, not a promise about our conduct. Even if the code tried to write to your repository, GitHub would refuse it.
What it reads
- Push and workflow events for the repositories you install it on.
- Your repository's source, at the specific commits it analyzes. A shallow clone is made inside an ephemeral container, the dependency graph is computed, and the container is destroyed. The clone does not outlive the analysis.
- The results and timings of CI runs that have already finished — the same information the Actions tab shows you.
What it stores
| Kept | Not kept |
|---|---|
| Analysis records: commit SHAs, changed file paths, which tests would have been selected, confidence and fallback reasons, and the reconciled CI outcome and timings. | A copy of your source tree. It exists only inside the analysis container and is destroyed with it. |
| Evidence archives for the analyses themselves, so a result can be audited later rather than taken on trust. | Credentials, tokens, or secrets of yours. DiffCI never receives any, and the analysis environment is built from an allowlist rather than inherited from the surrounding process. |
| Which repositories are installed, and when. | Anything from private repositories you did not install it on. |
Analysis records and evidence are stored in Cloudflare D1 and R2, on infrastructure operated for DiffCI. They are not sold or used to train models.
Product analytics
DiffCI uses PostHog's US Cloud to measure installations, repository access changes, suspensions, uninstalls, first predictions, and report delivery. These events contain pseudonymous installation and repository identifiers, counts, timestamps, and an internal/test account flag. They do not contain repository names, source code, file paths, report contents, credentials, or installer email addresses. A delivered report does not establish that a person read it.
Product analytics are separate from the analysis records and evidence covered by the deletion rules below. Contact us to request deletion of analytics associated with your installation.
How long
- Uninstalling deletes it. Removing the App from a repository deletes that repository's analysis records and evidence archives.
- 90 days maximum, regardless. Nothing is kept beyond 90 days from the analysis that produced it, whether or not the App is still installed.
- Ask, and it goes sooner. A deletion request is honored without asking why.
Aggregate statistics that cannot identify a repository — for example, "measured selection ratios across all observed repositories" — may outlive the underlying records. Nothing that names your repository, your commits, or your file paths does.
What we may publish
Nothing naming your repository, without your explicit written agreement to that specific text. Not the name, not the numbers, not "an unnamed fintech with a large monorepo" if the description would identify you.
The case studies on this site cover public repositories analyzed entirely from public data, and each one says so on its own page. A pilot participant is in a different position, and is treated differently.
Contact
Report suspected vulnerabilities privately to security@diffci.com. For deletion or privacy requests, use the contact form; include a reply address if you want confirmation. The self-service route works immediately: uninstalling the App from GitHub's Settings → Installations page triggers erasure of that repository's records, as described above. The public source is maintained in the DiffCI GitHub organization.