Privacy Policy

When you connect CodePulse to your GitHub account, we collect and process the following information to provide our engineering analytics service.

We use your information solely to provide and improve the CodePulse engineering analytics service:

Analytics & Metrics: - Calculate DORA metrics (deployment frequency, lead time, change failure rate, MTTR) - Generate cycle time analysis and team velocity metrics - Identify knowledge silos and collaboration patterns - Recognize contributions through team awards, such as thorough reviews and mentoring - Ranked per-developer comparisons are off by default; only an organization admin can turn them on

Service Operation: - Authenticate your identity via GitHub OAuth - Display dashboards and reports in the CodePulse interface - Send service-related notifications (sync status, alerts you configure)

Service Improvement: - Analyze how the product is used, including session replays of the CodePulse interface, to improve it - Debug and fix technical issues

AI Features: - Some features send limited data to AI providers to generate a result: pull request summaries; matching AI-tool accounts to developers; drafting replies to your support messages; and turning your organization's metrics into personalized summary emails, which are sent only to your own team. An organization admin can switch AI features off in settings; while they are off, we send none of your organization's data to AI providers. The providers and the data each receives are listed in our sub-processor list.

We do NOT: - Sell your data to third parties - Use your organization's engineering data (repositories, pull requests, developer activity) for advertising or ad targeting - Share individual developer metrics outside your organization - Train AI models on your code or data

How we protect your information:

Encryption: - Connected-service credentials: access tokens and secrets for connected services are encrypted with Fernet (AES-128-CBC with HMAC-SHA256 authentication) before they are written to the database, and decrypted only in memory when they are used - Data in transit: TLS 1.2 or higher for every connection, with TLS 1.3 supported, and HTTP Strict Transport Security (HSTS) - Production database: encrypted at rest by Oracle Cloud Infrastructure - Backups: encrypted before they leave our hosting environment - Database: reachable only on a private network inside our hosting environment, never from the internet

Multi-Tenant Isolation: - Every customer-data query is scoped to your organization - Organization membership and role are verified before any protected request is served - Your organization's data is never combined with another organization's in a query result - Administrative actions by CodePulse staff are recorded in an audit log

Infrastructure: - Hosted on Oracle Cloud Infrastructure in the United Kingdom (London) - CodePulse controls are mapped to the applicable SOC 2 Trust Services Criteria - Encrypted backups every 6 hours, stored with Backblaze in the EU, restore-tested weekly - Network isolation between components - Customer access flows through authenticated application APIs

Retention: - Active data retained while your account is active - When an organization is deleted, its data is removed from our live database immediately - Encrypted backups are kept for 8 days, so deleted data is gone from every copy within 8 days

We do NOT sell your data. Ever. Our business model is software subscriptions, not data brokering.

We do NOT share your organization's engineering data with third parties for marketing, advertising, or any other commercial purpose.

Service providers we use: - Hosting and backups: Oracle Cloud Infrastructure (United Kingdom) and Backblaze (EU, encrypted backups) - Email and billing: Resend and Stripe - AI features: Anthropic and OpenAI, for the features described above - Product analytics: PostHog (usage events and text-masked session replays of the app) and Google Analytics - Error monitoring: a self-hosted Sentry instance operated by CodePulse in the United Kingdom - Advertising measurement: Google Ads and LinkedIn (see Cookies & Tracking) - Website session recording: Microsoft Clarity, on our public website only - Internal alerts: Slack, where our team handles support requests and reviews personalized summary emails before they are sent to you

The full list, with the data each provider receives and where it is located, is our sub-processor list. Each provider is bound by data processing terms that restrict it to providing its service to us.

Legal Disclosure: We may disclose your information if required by law, court order, or government request. We will notify you of such requests unless legally prohibited from doing so.

You maintain full control over your data at all times:

Access: You can see your organization's data in the CodePulse dashboard. For a copy of anything else, including everything we hold about one developer, email privacy@codepulsehq.com.

Export: Download the data behind each report as CSV from that report's page. For a full export, email privacy@codepulsehq.com.

Delete: An organization admin can delete the organization from Settings. Its data is removed from our live database immediately and from our encrypted backups within 8 days. If your subscription ends and you have not deleted the organization, we delete its data 30 days after the agreement ends, unless you ask us to return it first.

Revoke Access: A GitHub organization owner can revoke CodePulse's access at any time: 1. Go to your GitHub organization → Settings → GitHub Apps 2. Find CodePulse and click "Configure" 3. Choose "Uninstall" to end access, or change which repositories CodePulse can read

Modify Scope: Add or remove repositories from analysis at any time. We only sync data from repositories you explicitly choose.

GDPR Rights (for EU users): - Right to access: See your data in the dashboard, or ask us for a copy - Right to rectification: Contact us to correct inaccurate data - Right to erasure: Delete your organization from Settings, or ask us to delete specific data - Right to data portability: Export report data as CSV, or ask us for a full export - Right to object: Contact us to opt out of specific processing

Authentication Tokens: We use JWT (JSON Web Tokens) stored in your browser's localStorage to maintain your authenticated session. The access token expires after 30 minutes and is renewed with a refresh token.

Local Storage: We store your preferences (selected organization, dashboard settings) in localStorage for convenience.

Analytics & Session Recording: We use analytics tools to understand how people use CodePulse and to improve it:

PostHog (inside the app): - Usage events such as pages viewed and features used, linked to your CodePulse account. Events record what you clicked, not the text on screen - Session replays of the CodePulse interface, with all on-screen text and form inputs masked, so a replay shows layout and clicks rather than your data

Google Analytics: - Page views and navigation patterns - Device and browser information - Traffic sources and referrals - For signed-in users, your CodePulse user ID and organization, so usage can be analyzed per account

Microsoft Clarity (public website only): - Mouse movements, clicks, scrolls, and session replays on our public pages - Clarity is switched off as soon as you sign in, and never loads for a signed-in session

Error monitoring (Sentry, self-hosted): - Technical details of errors, linked to your account so we can fix them - Replays of the session around an error, with all on-screen text and images masked

You can learn more about their privacy practices: - PostHog: https://posthog.com/privacy - Google: https://policies.google.com/privacy - Microsoft Clarity: https://clarity.microsoft.com/privacy

Advertising Measurement: To measure which of our ads lead to sign-ups, we load the Google Ads and LinkedIn Insight tags after your first interaction with a page. These use cookies. For signed-in users we send Google a SHA-256 hash of your email address, which Google uses to match your sign-up to an ad you clicked. We never send your organization's engineering data to advertising platforms.

What We Don't Do: - Record keystrokes or form inputs - Collect payment details (Stripe handles payments) - Track your activity on sites other than CodePulse

CodePulse is a professional engineering analytics tool intended for use by software development teams and organizations.

Our service is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13.

If you believe we have inadvertently collected information from a child under 13, please contact us immediately at privacy@codepulsehq.com and we will promptly delete such information.

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons.

How we notify you: - Material changes: Email notification to account administrators - Minor changes: Updated "Last modified" date on this page - All changes: Posted to this page with an updated "Last modified" date

Your continued use of CodePulse after changes are posted constitutes acceptance of the updated policy.

We encourage you to review this policy periodically.

Last modified: September 2026

If you have questions about this Privacy Policy or our data practices, please contact us:

Keep Pushing Forward Ltd (trading as CodePulse) Registered in England and Wales, company number 15087012.

Email: privacy@codepulsehq.com

For security concerns: security@codepulsehq.com

We aim to respond to all privacy inquiries within 5 business days.