Privacy Policy
Last updated: September 23, 2026
Fixor (“we”, “our”, or “us”) provides automated security review for GitHub pull requests. This Privacy Policy explains what data we access, what we store, who else processes it, and what control you have. We try to keep the policy short and concrete — if anything is unclear, contact us (section 9).
1. What we access from GitHub
When you install Fixor on a GitHub user account or organization, our GitHub App receives:
- Pull request code — for each PR Fixor scans: the pull request's diff, the full content of each file the pull request changes and, for route files, the parent layout files that can guard them, all read at the pull request's head commit.
- Read access to every file in the repository — the GitHub App holds GitHub's Contents permission at read level, so it can read any file in each repository you install it on. A scan reads only the pull request code described above.
- Repository metadata — repo full name, PR number, head commit SHA.
- Installation events — when Fixor is installed, updated, or uninstalled.
- Your installer email (optional) — when you sign in to the dashboard with GitHub OAuth, we receive your primary email from GitHub via Clerk.
Fixor does not read issues, discussions, releases, secrets, environment variables, GitHub Actions logs, or any other file in the repository.
2. What we store, and for how long
Fixor stores the minimum needed to deliver the service. Code from your pull requests is processed in memory and is not stored in our database after the scan completes. The PDF report is the exception: it includes an excerpt of each flagged code location (see the last row below). Specifically, our database contains:
| Data | Why we store it | Retention |
|---|---|---|
orgs — one row per GitHub installation: installation id, plan tier, monthly cap, Paddle customer / subscription ids (when paid), installer email |
Identify your account, route billing, send transactional email | Kept while Fixor is installed. Uninstalling does not delete it automatically; email support@fixor.dev and we delete it within 30 days of your request. |
installations — one row per GitHub installation: installation id, first-seen and last-seen timestamps |
Attribute scans and costs to an installation | Same as the org row |
org_settings — severity threshold, ignored globs, enabled detectors, optional Slack webhook |
Apply your filtering preferences to scans | Same as the org row |
cost_ledger — one row per priced Anthropic API call made for your installation: timestamp, USD cost, model, token counts, and for a pull request scan the id of its scan_runs row (no diff content) |
Enforce monthly budget caps; show your spend in the dashboard | Kept while Fixor is installed; deleted with your org on request, as above. No automatic expiry. |
scan_runs — one row per pull request event Fixor acted on, including events it did not scan because the budget was reached or could not be verified: repo + PR number, head SHA, GitHub's delivery id for the event, status, finding counts per detector, fixes generated, cost, a fixed status message (never code or raw error text), started/finished timestamps. Events Fixor ignores, such as a label or an assignee change, get no row. |
Show scan history + trends in the dashboard, only to people who can access that repository on GitHub; recognize a redelivered event so it is not scanned or charged twice | Same as cost_ledger |
audit_log — settings changes, plan changes, webhook events |
Security trail for billing + settings | Same as cost_ledger |
api_tokens — SHA-256 hashes of any API tokens issued to you on request (there is no self-service creation today; the plain token is shown to you once and never stored) |
Authenticate API calls | Revoked tokens remain as unusable hashes until your org is deleted on request. |
| Generated PDF + SARIF reports, stored at Cloudinary (not in our database). The PDF includes excerpts of flagged code. | Linked from the PR comment for download | Stored until deleted on request. The link in the PR comment works for one hour after the scan, and during that hour anyone who can see the pull request can open it; on a public repository, that is anyone. |
The PR comment itself is owned by GitHub, not us; deleting the PR or the comment is a GitHub action and we don't retain a copy.
3. How we use your data
- Analysis. Content from the files described in section 1 is analysed by Fixor's engine; the detectors that use a model send that content to Anthropic's Claude API (the secrets check does not). The detectors look for authentication bypass, IDOR, weak admin checks, environment-variable exposure, hardcoded secrets and unverified webhooks, and produce an explanation and remediation steps for each finding. Code sent to Anthropic is not used to train models. (See Anthropic's Trust Center for their commitments.)
- Billing. When you upgrade to a paid plan, Paddle (our merchant of record) processes the payment. We send Paddle the price id and a correlation id; Paddle returns the customer + subscription ids we store on your
orgsrow. - Transactional email. We email you on first scan, on payment events (welcome / payment failed / subscription canceled), and once per calendar month if you cross 80% of your monthly Anthropic budget. We do not send marketing email.
- Diagnostics. Server logs include installation id, PR number, and error stack traces. Sensitive values (API keys, GitHub App private keys, Stripe-style ids) are redacted at the logger layer.
4. Subprocessors
The following third parties process data on our behalf:
| Subprocessor | Purpose | Region |
|---|---|---|
| Anthropic | Analysis of pull-request code (Claude API) | USA |
| Neon | Postgres database (orgs, settings, ledger, audit log) | USA / EU (your project's region) |
| Railway | Backend webhook + analysis runtime | USA |
| Vercel | Dashboard hosting | USA / EU |
| Clerk | GitHub OAuth + dashboard sessions | USA |
| Paddle | Payments + merchant of record (handles VAT / sales tax) | USA / EU / UK |
| Resend | Transactional email delivery | USA |
| Cloudinary | PDF + SARIF report storage (signed URLs, 1h TTL) | USA |
| Sentry | Server error tracking | USA |
| GitHub | Webhook source; we are a GitHub App | USA |
We don't sell your data to anyone, and we don't add tracking pixels or third-party analytics on the marketing site.
5. International data transfers
Most of our subprocessors process data in the United States. If you're an EU/UK/EEA user, transferring data outside those regions relies on the Standard Contractual Clauses each subprocessor publishes. Paddle, as merchant of record, additionally handles GDPR / UK-GDPR compliance for the billing relationship.
6. Cookies and tracking
The marketing site (fixor.dev or the GitHub Pages URL) sets no cookies and runs no analytics. The dashboard sets a Clerk session cookie when you sign in — required to keep you logged in — and nothing else. We do not use third-party trackers, ad networks, or fingerprinting.
7. Your rights
- Access. Email us and we'll send you a JSON export of every row in our database that references your org.
- Deletion. Email support@fixor.dev to have your org, every row that references it and its stored reports deleted within 30 days of a verified request. Uninstalling alone does not currently trigger deletion.
- Correction. Most settings are editable directly in the dashboard. For anything else, email us.
- Portability. The JSON export above doubles as your portability artifact.
- Objection. You can opt out of transactional email by uninstalling; we don't send marketing email so there is no separate opt-out for that.
EU/UK/EEA residents have the additional rights granted by the GDPR / UK-GDPR — including the right to lodge a complaint with your local supervisory authority. California residents have the rights granted by the CCPA / CPRA. We respond to verified rights requests within 30 days.
8. Security
- GitHub webhooks are verified with HMAC-SHA256 against our shared secret (5A series).
- Paddle webhooks are verified with HMAC-SHA256 against the Paddle webhook secret, with a 5-minute replay window.
- Installation tokens are short-lived (≤1 hour) and never stored.
- Database connections use TLS; report URLs are signed (1-hour TTL by default).
- API token strings are stored only as SHA-256 hashes; the plain token is shown to you exactly once when the operator issues it.
9. Contact
Email support@fixor.dev for privacy questions, data export, or deletion requests. For non-privacy issues, you can also open a GitHub issue at github.com/tornidomaroc-web/fixor.
10. Changes
Material changes to this policy are announced on the GitHub repository and reflected on this page with an updated date at the top. Continued use of Fixor after a change constitutes acceptance of the updated policy.