Security & data
We read your code. Here's exactly how far that goes.
A tool that generates quests from your repository has to be precise about what it touches, what it keeps, and who else sees it. This page is that accounting.
Scanning happens on your machine.
The VS Code extension reads your working copy locally and sends our API the targeted excerpts it needs for analysis and quest generation — the code a candidate is anchored to, not a clone of your repository. What leaves your machine is the material a quest is built from.
The GitHub App is read-only.
The App is used to verify which repositories you've connected and — if you grant it — to read merged pull-request metadata so quests can carry provenance ("this file last changed in PR #N"). PR facts are verified against commit SHAs before use and stored with author identities redacted. Decline the permission and everything else keeps working.
One LLM provider. No training on your code.
Repository content is processed by Anthropic's API to generate and evaluate quests — no other model provider. Under Anthropic's API terms, data submitted to the API is not used to train their models. Every LLM call we make is recorded in an internal audit log: what was sent, when, and for which quest.
What we store, and how.
Postgres on Supabase, TLS in transit, encryption at rest. We store your account, connected-repo records, the excerpts and candidates scans produce, and the quests, submissions, and evaluations you generate by using the product. Quest answer keys live server-side only — they are stripped from every payload the client sees.
Tokens you can revoke, stored hashed.
The extension token that links VS Code to your account is shown to you exactly once; we keep only a hash. Rotate it any time from Account settings — the old token dies immediately. GitHub access can be revoked from GitHub's side at any time by uninstalling the App.
The formal version — sub-processors, GDPR bases, retention, and your rights — lives in the privacy policy. Anything unclear, ask us directly via contact.