Privacy Policy

Effective: September 18, 2026

1. Overview

This Privacy Policy explains how Sentaryn ("Sentaryn", "we", "us", or "our") handles information in connection with sentaryn.com, the Early Access / founder-assisted access form, Sentaryn Free GitHub setup, and use of the current live Sentaryn Free GitHub product.

Sentaryn Free provides informational authority evaluations for AI-generated software changes. It does not enforce its decisions. This policy distinguishes documented setup and website handling from evaluation-runtime details that are not yet publicly documented.

2. Information you provide

When you submit an Early Access / assisted-access request, we may collect:

• your name;
• business or work email address;
• company or organization name;
• role or job function;
• team-size range;
• AI coding agents or development tools you use;
• a repository URL, if you choose to provide one;
• information you provide about your concerns, requirements, or use case; and
• administrative information such as submission time and application status.

During Sentaryn Free setup, you choose a repository from the verified installation's available repositories and request activation of the supported Shadow configuration.

3. GitHub setup and product information

Setup uses GitHub authentication to verify an installation against the authenticated user's accessible installations and obtain repository options for that installation. An installation supplied in the setup URL is a candidate to verify, not proof of access.

The setup backend stores the following categories in Cloudflare D1:

• GitHub installation identity and the installation account's login/type;
• repository IDs, full names and GitHub URLs associated with the setup session;
• the activated repository's Sentaryn Free plan, mode, policy and configuration status;
• authentication and setup-session records used to verify setup; and
• creation, update and expiry times, and session/authentication lifecycle state.

Authentication and setup sessions

Setup processes a GitHub authentication code and state and exchanges the code server-side. The returned GitHub user access token is used to verify installation access and discover repositories. In this setup flow, access tokens and any returned refresh tokens are not persisted in D1 or returned to browser JavaScript. Processing information does not mean every field is stored.

Sentaryn uses a setup-session cookie and server-side session state necessary to associate setup requests with verified installation and repository information. Authentication state and setup-session tokens are stored as digests rather than their original values. Session expiry limits use of the session; it is not a GitHub token lifetime or a data-deletion schedule.

Evaluation-runtime details

Sentaryn Free provides authority evaluations that users review in GitHub, as described in the Docs. A complete inventory of the evaluation service's information processing, storage and logging is not documented here. This includes unresolved source-code handling. The setup token and storage statements above apply to setup, not the evaluation runtime; they do not establish that source code cannot be accessed or stored.

4. Website security and technical information

We use Cloudflare infrastructure to deliver and protect the website, including Cloudflare Turnstile for bot and abuse protection. Cloudflare may process network, device, and security signals as part of providing those services.

Sentaryn does not intentionally store visitor IP addresses in the early-access application database. Infrastructure providers may independently process technical information in accordance with their own terms and privacy practices.

5. How we use information

We may use information in connection with these services to:

• review assisted-access requests and communicate about Sentaryn or optional collaboration;
• authenticate and verify GitHub setup;
• associate an installation and repository with supported Shadow configuration;
• provide Sentaryn Free and its informational authority evaluations;
• understand prospective customer requirements and product use cases;
• operate, secure, troubleshoot and improve the website, intake and Sentaryn Free service;
• detect abuse, fraud, automated submissions, or security threats; and
• comply with applicable legal obligations.

6. Service providers and sharing

We may provide information to infrastructure and service providers that help us operate Sentaryn where reasonably necessary to provide those services.

GitHub provides App installation, user authentication and repository access for setup. Cloudflare provides website/backend infrastructure, D1 persistence for setup and intake, and Turnstile for website-form abuse prevention. These services may process information under their own terms and privacy practices. These named services are not a verified complete list of providers involved in the evaluation runtime.

We may also disclose information where required by law, legal process, or to protect the rights, security, or integrity of Sentaryn, our users, or others.

We do not sell early-access applicant personal information and do not use the information submitted in the early-access form for third-party targeted advertising.

7. Repository access and confidential material

The early-access form may allow you to provide a repository URL. Do not submit passwords, API keys, access tokens, private source code, confidential credentials, or other secrets through the form. Providing a repository URL does not grant Sentaryn access to a private repository.

GitHub App installation access is separate from providing a URL in the form. Review the access GitHub displays during installation. Sentaryn setup selects from the repositories returned for the verified installation; activation uses the repository identity held in the setup session and does not expand GitHub App installation access. This policy does not specify an exact App permission set or webhook event list.

8. Data retention

We retain information for as long as reasonably necessary for the purposes described in this policy, including operating and securing the service, communicating about requests, maintaining appropriate business records and satisfying applicable legal obligations. No fixed GitHub-product retention period or automatic deletion schedule is documented here.

9. International processing

Sentaryn uses internet infrastructure and service providers that may process information in countries other than the country where you are located. Their own terms and privacy practices also describe their handling of information.

10. Your privacy choices and rights

You can remove Sentaryn's GitHub access by uninstalling the App from the relevant GitHub installation. Removing GitHub access does not establish deletion of previously stored Sentaryn records. Data-removal questions and privacy requests are separate from uninstalling the App.

Depending on where you live, you may have rights relating to your personal information, which can include requesting access, correction, deletion, restriction, or objection to certain processing.

To make a privacy request, contact legal@sentaryn.com. We may need to verify your request before acting on it.

11. Children

Sentaryn is a business-oriented software service and is not directed to children. The early-access application is not intended for anyone under 18 years of age.

12. Security

We use technical and organizational measures intended to protect information handled through the service. No internet service or storage system can be guaranteed to be completely secure.

See Security for the documented setup controls and their scope. Those setup controls are not system-wide evaluation-runtime security guarantees.

13. Changes to this policy

We may update this Privacy Policy as Sentaryn develops or as our practices or legal obligations change. The effective date at the top of this page indicates the current version.

14. Contact

Questions or privacy requests may be sent to legal@sentaryn.com.