Privacy Policy

1. Introduction

Videlic ("Videlic", "we", or "us") provides a platform that reviews AI coding-agent sessions and reports what an agent changed and whether the work can be trusted. This Privacy Policy explains what information we collect through videlic.dev and the Videlic service, how we use and share it, and the rights and choices you have. By using Videlic, you agree to the practices described here.

2. Information we collect

Account information. When you create an account or sign in, we collect your name, email address, and basic profile details from the provider you sign in with, such as GitHub or Google.

Session content. Each time your coding agent stops and hands control back to you, the hook you install sends us the transcript of that session so far. It does this for sessions in any folder on your computer, including folders that are not git repositories. The transcript includes your messages to the agent, the agent’s messages, the files it read, the commands it ran and what they printed, and the changes it made. That is everything the agent read, ran or wrote during the session, including files and command output from folders outside the one it started in. When the session runs inside a git repository, the hook also sends the branch, your current commit, and the address of the repository’s remote. If it finds the branch’s pull request, it also sends that pull request’s number, link, state, base branch and latest commit.

Repository details. When the session runs inside a git repository, the hook then reads that repository on your computer and sends us details of it to make your report. It sends the path of every file git tracks in your repository, up to 200,000, and which of your files import which. It sends the name and location of each package in your repository, and the name, entry points, types, exports and imports fields of each package.json. It sends the full text, as it is on your computer, of the files your branch has changed since it left your default branch, and of their test files. It sends your current commit, the name of your repository’s default branch, and whether you have uncommitted changes. And it sends the full path of the repository folder on your computer, which can include your username and folder names.

If Test visibility is turned on for your workspace and the session’s branch has an open pull request, the hook also asks your project’s test tool, on your computer, to list (not run) the test files for the test commands your agent already ran in the session. It sends us that list, each command, and the folder it was asked from, including that folder’s full path on your computer. Test visibility is off until a workspace owner or admin turns it on.

From GitHub. If our GitHub App is installed on the repository, we also read from GitHub, to make your report: the pull request’s code changes, its list of changed files and its details, the repository’s list of files at the pull request’s latest commit, and the changes in the session’s own commits; and, when a session’s agent left work in the repository, the text of the pull request’s changed files that work is in, at its latest commit and at the commit it last shared with the branch it targets, to tell which session’s work a commit you made yourself contains. Without the App, our servers read nothing from GitHub. If you have GitHub’s gh tool installed and signed in, the hook uses it, with your own GitHub login, to ask GitHub which pull request your branch belongs to, and on later stops which pull requests your earlier sessions’ commits ended up in.

This is the content we analyze to produce your reports. We store session transcripts as we receive them, without first removing passwords, API keys, or other secrets they contain, and the records we build from them can contain the same text.

Usage information. We collect limited information about how you use the product, such as the pages you view and the actions you take, to operate and improve the Service. To count visits, your browser keeps a random visitor ID in its local storage, which is sent with the address of the page, the address of the page that brought you there, and any campaign tag in the link; once you sign in, it is linked to your account. Open any page with ?nocount=1 to turn this off in that browser.

Payment information. Payments are handled by Paddle, our merchant of record. We receive your plan, your invoices, and your card’s type, last four digits, expiry date and the name on it, and we keep the payment notifications Paddle sends us, which contain these details. We never receive or store your full card number.

People you invite. When you invite someone to your workspace, we keep the email address you give us, send them the invitation through our email provider, and record the invitation in the workspace’s audit log.

Enterprise inquiries. If you use the Enterprise contact form in billing, we keep the company, name, email, team size and notes you enter, together with your browser’s user agent and a hash of your IP address.

3. How we use information

We use the information we collect to:

• provide the Service — analyze your sessions, produce reports and verdicts, and deliver them to your connected repositories and dashboard;
• operate your account, including sign-in, billing, and support;
• send you service messages, such as sign-in, billing, and account notices, and any updates you ask to receive;
• keep the Service reliable and secure;
• improve and develop the Service, including the quality and accuracy of our analysis, using aggregated or de-identified data where possible;
• meet our legal obligations and enforce our Terms of Service.

4. AI analysis

To produce a report, we send what the analysis needs to Anthropic’s Claude API. The code changes we send are the files the agent wrote or edited in the session, including any outside the repository. When the session has a pull request and our GitHub App is installed, we send the whole pull request’s changes instead, which can include code written outside the session. Along with the code changes, we send your messages to the agent; the agent’s replies, plan, and task list; the names of the changed files; some of the commands the agent ran; and the results of the tests and checks it ran (counts and pass or fail, not their output). We do not remove passwords, API keys, or other secrets from this text before sending it. We use the Claude API under terms where your content is not used to train its models. Anthropic’s handling of content sent to its API is also governed by Anthropic’s Privacy Policy.

5. How we share information

We do not sell your personal information or session content, and we do not share it for advertising. We share it with these service providers, only as far as each needs it to run the Service:

• Anthropic — AI analysis of session content;
• Supabase — database, sign-in, and storage of session transcripts and repository details;
• Railway and Vercel — hosting for our servers and website;
• Paddle — payments, as our merchant of record;
• GitHub — reading the repositories you install our GitHub App on and posting results on their pull requests;
• Resend — email delivery;
• Sentry — error and performance monitoring. When something fails, and for a sample of ordinary requests, it receives technical details such as error messages, timings, the pages and web addresses involved, and internal IDs of the affected workspace or session. These details can include the names of your repositories and files. For other requests it receives only counts;
• Linear and Slack — where our team gets alerts when something breaks; an alert, which can also reach us by email, can include an internal workspace ID and an error message.

Others can also see your reports. If our GitHub App is installed on the repository, it posts the result as a comment on the session’s pull request, unless a workspace owner or admin has turned pull-request comments off. The comment can quote, word for word, part of a message you sent the agent and part of the agent’s reply. Anyone who can see the pull request can read it, which on a public repository means anyone, and GitHub can also send it by email to people who follow the pull request. Any member of your workspace can open a session’s report from its link, such as the one in the pull-request comment. On a Team plan every member’s dashboard also lists the workspace’s flagged sessions and who ran them, and owners and admins see every member’s sessions in their list. Anyone given a report’s share link can open it; you can create one for your own reports, and a workspace owner or admin can create one for any report in the workspace.

When we show a report, a page you share, or a pull request comment we write, we mask recognised credential formats and email addresses in it at that moment. This does not remove them from the session transcripts we store or from what we send to Anthropic for analysis, and a comment we wrote before we recognised a format can still show it, in the comment, in its edit history on GitHub, or in an email GitHub sent about it.

We may also disclose information where required by law, or to protect the rights, safety, and security of Videlic, our users, or the public.

6. International transfers

Videlic and some of our service providers operate in the United States and other countries, so your information may be processed outside the country where you live. Where we transfer personal information across borders, we rely on appropriate safeguards as required by applicable law.

7. Data retention

Session transcripts and repository details. We keep the transcript the hook uploads for 30 days after we first receive it, or 90 days if the session is linked to a pull request. Each set of repository details the hook sends is kept on the same terms, counted from when that set first arrives. After that our daily cleanup deletes them. If you keep working in the same session after that, the next upload that carries new work is stored again, for a new 30 or 90 days.

Reports and session records. For sessions linked to a pull request, the report and the session record we build from the transcript — your messages, the agent’s messages, every command and tool it used and what each returned (long results shortened to their start and end), including the contents of files it read, and the changes it made — are kept for as long as the workspace exists. Sessions never linked to a pull request are deleted, with everything we built from them, once their transcript has been deleted and nothing has happened in them for 14 days.

Account and usage information. We keep your account information while your account is active. If you are removed from every workspace you belong to, your account record is deleted 90 days after the last removal. Records of the pages you view are kept for about 13 months. Records of sign-up and setup steps, such as signing in, connecting the hook or a review starting, are kept with no set end date; when your account is deleted, they are unlinked from it. Each workspace keeps an audit log of actions taken in it for 90 days; on a Team plan, everyone in the workspace can see it in Settings → Audit log. An invited person’s email address is kept until the invitation is cancelled or the workspace is deleted, including after they accept. Enterprise inquiries are kept with no set end date.

Deleting your account. Deleting your account deletes, straight away, every workspace you own, for everyone in it, with its reports, session records and settings, and first cancels their paid plans with our payment provider; time already paid for is not refunded. If a paid plan cannot be cancelled, your account is not deleted. It also removes you from workspaces you were invited to, whose plans are not affected, and the tokens your hook used stop working; remove the hook from your computer too, or it keeps trying to send your sessions, which we refuse. Your account record is deleted with them. Within a day we also delete your sign-in record and the stored transcripts and repository details of the workspaces you own. Sessions you sent to a workspace someone else owns belong to that workspace and stay there, no longer linked to your account, until that workspace is deleted; sessions never linked to a pull request are deleted earlier, on the schedule above.

An Enterprise inquiry you sent stays until you ask us to delete it: email hello@videlic.dev and we will. Comments we posted on pull requests stay on GitHub until they are deleted there. Copies can also remain for a limited time in our backups and service logs until they expire. Our payment provider, Paddle, keeps its own payment records as the law requires, and we keep the payment notifications Paddle sent us, with no set end date.

8. Security

We protect your information with encryption in transit and at rest and restricted access to production systems. We store CLI tokens only as hashes once they have been used; a new token stays readable until your computer first uses it or you delete it, so the setup screen can show it again. No method of storage or transmission is perfectly secure, but we work to safeguard your data and to respond promptly if a problem arises.

9. Your rights and choices

Depending on where you live, you may have the right to:

• access the personal information we hold about you and receive a copy;
• correct information that is inaccurate or out of date;
• delete your account from your settings — section 7 says what is deleted straight away and how to have the remaining copies removed;
• object to or restrict certain processing, and withdraw consent where our processing relies on it;
• opt out of non-essential email at any time.

To exercise any of these rights, email us at hello@videlic.dev. You may also have the right to complain to your local data-protection authority.

10. Cookies

We use only the essential cookies needed to sign you in and keep you signed in; the visitor ID described in section 2 is kept in your browser’s local storage, not in a cookie. We do not use advertising or third-party tracking cookies or pixels. Signed-in pages load the checkout script of our payment provider, Paddle, which may set its own cookies to process a payment.

11. Children’s privacy

Videlic is intended for professional use and is not directed to anyone under 16. We do not knowingly collect personal information from children.

12. Changes to this policy

We may update this policy from time to time. If we make material changes, we will let you know by email or an in-product notice before they take effect. Your continued use of the Service after an update means you accept the revised policy.

13. Contact

If you have any questions about this policy or your data, email us at hello@videlic.dev.