1Who we are
Diffport provides a service that reads the repositories you connect and reports the provenance of the code inside them — which parts were written by a machine, which by a person, and which carry no signal at all.
This policy covers the Diffport website, the application at
app.diffport.com, and the interfaces at api.diffport.com. In this
policy, we and Diffport mean Diffport, and you means the person or
organisation using the service.
For any question about this policy or about the information we hold, write to legal@diffport.com.
2What we collect
We collect four kinds of information, and nothing outside them.
Account information
Your name, email address, and a cryptographic hash of your password. If you sign in with GitHub we also store your GitHub login. If you upload a profile picture we store the image. We store your interface preferences, such as density and notification settings.
Repository information
When you connect a repository we read and store, for the repositories you grant:
- Commit metadata — the commit identifier, message, branch, timestamps, and the author and committer names and email addresses as recorded in your git history
- Pull request metadata — number, title, branch, state, review and merge timestamps, and the counts of files and lines changed
- File changes, including the text of the change, for the commits we process
- Database migration files, from which the schema view is reconstructed
- The results we derive from all of the above — provenance verdicts, the signals behind them, confidence, risk scores, and agent attribution
Author names and email addresses in commit metadata are personal information about your contributors. They are present because git records them, and we process them to attribute authorship, which is the purpose of the service.
Billing information
A Stripe customer identifier, a subscription identifier, a subscription status, a quantity, and a renewal date. That is the entire billing record we hold.
Operational information
When you sign in we store a hash of the session token together with the IP address and browser user agent of the session. When you write to us through the support form we store your name, email address, message, any screenshot you attach, and the IP address and user agent of the submission. If you joined a waiting list we store the email address you gave, the referral code issued to you, how you arrived, and the IP address and user agent of the submission.
3What we never collect
The following are not collected, not stored, and not accessible to us. Each is a property of how the service is built rather than a promise about how we behave.
- Your database. We hold no database credentials of yours and make no connection to any database you operate. The schema view is reconstructed from migration files in your repositories.
- Your payment card. There is no payment form anywhere in Diffport. Card details are entered on pages hosted by Stripe and never reach our servers.
- Anything from your AI vendor. We hold no credentials for, and make no request to, any AI provider. Which tool wrote something is determined from your repository.
- Write access to your code. The GitHub App does not request it, so it cannot push, open or merge a pull request, or alter a branch or a setting.
The permissions actually granted are set out on our Security page.
4Why we collect it
We process information for these purposes and no others.
We do not sell information about you. We do not share it for advertising. We do not use your repository content to train machine learning models, our own or anybody else's.
Where the law requires a legal basis for processing, ours is the performance of our contract with you for providing the service and taking payment, and our legitimate interests in securing the service and answering support requests.
5Cookies and tracking
Diffport sets cookies only where a cookie is doing necessary work. There is no advertising cookie, no analytics cookie, and no third-party tracking script anywhere on this website or in the application.
Your appearance preference — light or dark — is stored in your browser's local storage and never sent to us.
Our website loads two typefaces from Google Fonts. Because that request goes to Google's servers, Google receives the IP address and user agent of the browser making it. No cookie is set by that request and no other information is passed.
The application at app.diffport.com loads its typefaces from our own servers
and makes no request to Google.
6Who else touches it
We use a small number of providers to run the service. Each receives only what it needs for its function.
We do not otherwise disclose your information, except where we are required to by law, or where it is necessary to establish or defend a legal claim. If we are ever compelled to disclose information about you, we will tell you unless we are legally prohibited from doing so.
If Diffport is acquired or merged, information may transfer as part of that transaction. You would be told before it did, and this policy would continue to apply to information collected under it until replaced by one no less protective.
7Where it is held
Information is stored on servers operated by our hosting provider. Depending on where you are, that may mean your information is transferred to and processed in a country other than your own, including countries whose data protection laws differ from those where you live.
Where such a transfer takes place, we rely on the contractual protections in our agreements with the providers listed in section 6, and we transfer only what is necessary for the purposes in section 4.
8How long we keep it
When you delete a workspace, the repositories, pull requests, commits, provenance signals, alert rules and API tokens belonging to it are deleted with it.
9How it is protected
Every credential we hold that could be used to sign in is stored as a cryptographic hash rather than in a form anyone could use. That covers session tokens, password reset links, invitations and API tokens. Passwords are stored using a purpose-built password hashing function.
Workspaces are isolated from one another at the point where data is read, and that isolation is verified by an automated test that fails the build if one workspace can see another.
Our Security page describes these measures in more detail, including the measures we do not yet have. No system is perfectly secure, and we do not claim that ours is.
If we become aware of a breach affecting your information, we will notify you and any regulator we are required to notify, without undue delay.
10Your rights
Depending on where you live, you may have some or all of the following rights over information about you. We honour these requests regardless of whether the law where you live requires us to.
- Access. Ask what information we hold about you and receive a copy.
- Correction. Have inaccurate information corrected. Your name, email address and picture can be changed yourself in the application at any time.
- Deletion. Ask for information about you to be deleted. Deleting your workspace removes the information described in section 8.
- Portability. Receive information you provided in a structured, machine-readable format. The read API and the signed JSON and CSV exports provide this directly.
- Objection and restriction. Object to processing based on our legitimate interests, or ask us to restrict processing while a question is resolved.
- Withdraw consent. Where we rely on consent, withdraw it at any time without affecting processing already carried out.
Write to legal@diffport.com to exercise any of these. We will respond within thirty days, and we will tell you if we need longer and why. We will not charge you, and we will not treat you differently for having asked.
If you are unsatisfied with our response, you may complain to the data protection authority where you live.
Commit author names and email addresses come from your git history rather than from the people concerned. Where you connect a repository, you are responsible for having the right to do so and for informing your contributors as required by the law that applies to you.
If one of your contributors contacts us directly about their information, we will refer them to you, because you decide what happens to your repository, and tell you that we did.
11Children
Diffport is a tool for software teams and is not directed at children. We do not knowingly collect information from anyone under sixteen. If you believe a child has provided information to us, write to legal@diffport.com and we will delete it.
12Changes
We will update this policy when what we do changes. The date at the top always reflects the current version.
Where a change materially reduces your rights or materially widens what we collect, we will tell account holders by email before it takes effect, and we will describe what changed rather than only that something did.
13Contact
Questions about this policy, requests under section 10, and any other privacy matter go to one address.
A person reads these. We will acknowledge your message and tell you honestly how long the substantive answer will take.
legal@diffport.com