Privacy policy

Veridu is operated by T3 Interactive LLC. This policy covers the personal data we collect when you use veridu.io, the Veridu GitHub App, the MCP server and the CLI. How your code is handled, what is kept and for how long, is on the Data handling page, which is part of this policy.

What we collect

• Account: your email address, and when you sign in with GitHub or Google, the account identifier and GitHub username that provider returns. There are no passwords.
• Repositories you link: their names and the GitHub App installation, or an encrypted access token if you chose one.
• Usage: the reviews and checks you run, their results, and the reviews counted against your plan.
• Site analytics: pages visited and actions taken on veridu.io, with the browser's user agent, the referring page and your IP address. When you sign up we note the page you arrived on, the referring site, the device type, any campaign tags in the link (utm_source and similar) and any ad click identifier from Google, Microsoft or Reddit, so we can tell which channels bring people in.
• Billing: if you pay, Stripe collects your card details. We receive and keep the billing records Stripe sends us: your customer and subscription identifiers, your plan, subscription status and dates, invoices and payments (number, amount, period and the link to view them), and the full billing object contained in each Stripe event, which can include the billing name, email and address you gave Stripe. They never include your full card number.
• Messages: anything you send to hello@veridu.io or through the contact form.

Why we use it

To run the service (sign you in, review the changes you send, post results where you asked), to bill you, to send emails about your account and reviews, to prevent abuse of the free tier, and to understand which pages and features people use so we can improve them. We do not sell personal data, and we never train models on your code.

Who processes it

• Amazon Web Services (US): hosting, database, file storage, the review sandbox, and email delivery through Amazon SES.
• OpenAI and Anthropic: the reviewer models. They receive the code being reviewed, as described on Data handling, not your account details.
• GitHub and Google: sign-in, and GitHub for the repositories and pull requests you connect.
• Stripe: payments.
• Sentry: error reports and a 5% sample of performance traces from the website and the service, used to fix bugs. Reports from a signed-in browser carry your Veridu account number.
• Google Ads: a conversion tag on veridu.io. Its consent mode is set to denied, so it sets no advertising cookies; it measures ad conversions in aggregate.

Cookies and storage

veridu.io keeps your sign-in in your browser's local storage. We set no advertising cookies.

How long we keep it

Account, usage and billing records, site analytics and messages you send us are kept while your account exists; there is no automatic expiry for them yet. Retention for code, model output and review results is on Data handling. Account deletion is done by hand on request (below): we remove your reviews, results, linked repositories and stored tokens, and your analytics and messages on request. Payment records we are required to keep for tax and accounting are retained as the law requires.

Your choices

You can ask for a copy of your personal data, a correction, or deletion of a review or your whole account by emailing hello@veridu.io; account deletion is also under Billing → Danger zone. Requests are handled by hand within one business day. You can uninstall the GitHub App or revoke a token on GitHub at any time.

Where it is stored

In the United States (AWS us-east-1), encrypted at rest. Connections to veridu.io and the Veridu API use TLS. If you use Veridu from outside the US, your data is transferred there.

Children

Veridu is for software developers and is not directed at children under 16.

Changes and contact

We will post changes here and email account holders about material ones before they take effect. Questions: hello@veridu.io, T3 Interactive LLC.