Privacy Policy

This Privacy Policy explains what information CodeGuard AI (“CodeGuard AI”, “we”, “us”) collects when you use our application, how we use it, and the choices you have.

1. Information we collect

Account information. When you sign in, we store your name, email address, and profile picture, along with your GitHub username if you connect a GitHub account.

GitHub data. If you connect a GitHub account or repository, we access repository metadata, pull requests, and code contents only as needed to run security analysis, pull request auditing, and the features you explicitly use. We never access repositories you have not connected.

Google Calendar data. If you choose to connect Google Calendar, we request permission to create, update, and delete events on your calendar (the calendar.events scope) so that tasks assigned to you in CodeGuard AI can be kept in sync automatically. We do not read the rest of your calendar, and we only ever create or modify events that CodeGuard AI itself created for your tasks.

Content you create. Tasks, boards, comments, meeting notes, and context notes (“Cards”) you create or upload while using the product.

Usage data. Basic technical information (such as timestamps and error logs) used to keep the service reliable and secure.

2. How we use your information

• To provide and operate the core features of CodeGuard AI — boards, tasks, pull request analysis, and security scanning.
• To generate AI-assisted suggestions (for example, task suggestions from meeting notes, or security summaries) using Google's Gemini API. Only the minimum context needed for the specific request is sent.
• To keep tasks synced with Google Calendar, for users who explicitly connect it.
• To send you notifications about activity relevant to you (task assignments, comments, status changes).
• To maintain the security and integrity of the service.

3. Third-party services

We share the minimum necessary data with the following third-party services in order to provide our features:

• GitHub — repository and pull request access, via OAuth you explicitly grant.
• Google Calendar API — calendar event sync, via OAuth you explicitly grant and can revoke at any time.
• Google Gemini API — AI-generated suggestions and summaries.

We do not sell your personal information to anyone, and we do not share it with third parties for their own marketing purposes.

4. Data security

Access tokens for connected accounts (such as GitHub and Google Calendar) are encrypted at rest using industry-standard encryption (AES-256-GCM) and are never stored in plain text. We use encrypted connections (HTTPS/TLS) for all data in transit.

5. Your choices and rights

• You can disconnect your Google Calendar or GitHub connection at any time from within the app — disconnecting immediately stops any further access and sync.
• You can request access to, correction of, or deletion of your personal data by contacting us (see Section 8).

6. Data retention

We retain account and content data for as long as your account is active. If you delete your account or request deletion, we remove your personal data within a reasonable time, except where we are required to keep it for legal or security purposes.

7. Children's privacy

CodeGuard AI is not directed at children under 16, and we do not knowingly collect data from them.

8. Limited Use disclosure (Google Workspace APIs)

CodeGuard AI's use and transfer of information received from Google APIs (including the Google Calendar API) will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• Google Calendar data is used only to create, update, and delete calendar events that mirror your CodeGuard AI task assignments — never for any other purpose.
• Google Calendar data is never used, transferred, or sold to develop, improve, or train machine learning or AI models — generalized/foundational models or otherwise.
• CodeGuard AI's AI-assisted features (task suggestions, security summaries) run on content you create directly inside CodeGuard AI — such as task descriptions, meeting notes, and code. That AI processing never includes data read from your connected Google Calendar.
• Google Calendar data is never shared with, or made accessible to, any third party other than Google itself, solely to perform the sync you requested.

9. Contact us

If you have questions about this Privacy Policy or wish to exercise your data rights, contact us at pinarkarakoca3@gmail.com.

10. Changes to this policy

We may update this Privacy Policy from time to time. We will update the “Last updated” date above whenever we do.