Privacy Policy
coance is a service of Solid Software LLC, 451 W Huron St, Ste 1107, Chicago, IL, USA ("we" below). It enforces per-file review rules on GitHub pull requests through the coance GitHub App and shows repository metrics in the coance app. This policy explains what data coance processes to do that. Questions: support@coance.ai.
What coance stores
coance gets its data from GitHub, through the GitHub App you install and through your GitHub sign-in. It stores:
- Your account. When you sign in with GitHub, our authentication provider receives your GitHub user id, username and email address. coance keeps your GitHub user id and username with your account.
- Repository access. At sign-in coance reads which repositories of connected installations you can access on GitHub, and with which permission, so the app shows you only those. Your GitHub access token is used for that request and is not stored.
- Organizations. Each coance organization's name, its members and their roles (owner or member).
-
Installations and repositories. For each GitHub App installation: the
GitHub account id, name and type. For each repository: its id, full name, default branch,
whether it is private or archived, and its parsed
coance.yml(review levels, their descriptions, the thread template) with any configuration errors. - Pull requests. Number, title, author's GitHub username and id, base branch, head commit, state, whether it is a draft, when it was opened, closed or merged, and coance's review status with the ids of the comment and check it posted.
- Changed files. For each file a pull request changes: its path, its review level, its owners, the approvals it needs, lines added and deleted, and whether it is approved.
-
Approval history. Who approved which file (GitHub user id and username),
how (resolving the thread or replying
/approve), at which commit and when, and when a later commit voided the approval. - Metrics. For a repository's default branch: the commit measured, the total lines of code and the lines under each review level.
- Billing. Your organization's plan and subscription status, the period end, and the customer and subscription ids at our payment processor. Card details are entered on and held by Stripe; coance never sees full card numbers.
- Operational records. The server logs each request's method, path and result. The queue of evaluation jobs keeps the last error of a job that failed.
File contents
coance reads file contents from your repositories in three cases: its configuration files (
coance.yml, CODEOWNERS, .gitattributes), to apply
your rules; the files on your default branch, to count lines of code; and the replies in
coance's review threads, to find
/approve. It does not store file contents or reply text. What it keeps is
listed above: the parsed configuration, file paths, line counts and approvals.
What coance writes to GitHub
On your pull requests coance posts a review thread on each file that needs review, replies
in those threads, keeps one summary comment up to date, reports the coance
check, and requests reviews from the owners in your rules.
Subprocessors
| Provider | What for | Data |
|---|---|---|
| GitHub | Sign-in, and the source of repository and pull request data | Everything coance reads and writes on GitHub |
| Supabase | Database and sign-in, US East (us-east-1) | Everything coance stores, listed above |
| Google Cloud | The coance server and its job queue (Cloud Run, Cloud Tasks), us-central1 | Data in transit while coance processes it; server logs |
| Stripe | Payments and subscriptions | Billing contact and payment details you give Stripe |
| Cloudflare (Pages) | Serving this website and the coance app | Standard web request data |
Retention and deletion
coance keeps your data while its GitHub App is installed. When you uninstall the App or remove a repository from it, coance marks the installation or repository as deleted and stops processing it. Its data is deleted within 30 days.
Approval history is kept for audit, including approvals that a later commit voided, for as long as the repository's data is kept.
To have your organization's or your own data deleted sooner, email support@coance.ai from an address linked to the account. We handle deletion requests within 30 days.
Your rights
You can ask us for a copy of the data coance holds about you, and to correct or delete it, at support@coance.ai. Depending on where you live, you may have further rights, such as to object to or restrict processing, or to complain to your data protection authority.
Changes
We will publish changes to this policy on this page with a new effective date, and tell organization owners about material changes by email before they take effect.
Effective date: not yet in effect (draft).