Privacy Policy

Refact Ltd is a company registered in England & Wales and is the data controller for the personal data described in this policy. You can reach us about anything on this page at privacy@refact.app.

This policy covers the Refact website and the Refact deployment platform. It does not cover the third-party services your app is deployed to, which have their own policies.

We hold four kinds of data, and we collect each one only because a specific part of the product needs it:

• Account data: your name, email address and, if you sign up with a password, a bcrypt hash of it. We never store your password itself. If you sign in with GitHub or Google, we receive your name, email and provider account id from them.
• Repository data: for the repositories you explicitly connect, we read the source, the commit history metadata and the file tree in order to detect your stack and scan it. We hold the analysis result and the scan findings; we do not keep a permanent copy of your source code after a build completes.
• Deployment data: build logs, deployment status and history, uptime and response-time measurements for apps you deploy through us.
• Environment secrets: values you store in the vault, encrypted with AES-256-GCM at rest. They are decrypted only to be sent to your deployment provider at deploy time, and the dashboard shows a masked preview only.

We also collect basic technical data (IP address, browser type and timestamps) in server logs, which is unavoidable for running a service securely.

We process account, repository and deployment data to perform the contract we have with you: you asked us to analyse, scan and deploy a repository, and we cannot do that without reading it.

We process technical and security logs on the basis of our legitimate interest in keeping the service available and detecting abuse. We keep those logs short-lived and do not use them to build a profile of you.

If you join the waitlist, we hold your email on the basis of your consent, and we use it only to tell you when Refact opens up. Every email we send you includes a way to unsubscribe, and unsubscribing deletes the record.

We do not sell personal data, and we do not use your source code or your deployment data to train machine-learning models.

We use a small number of processors, each for one job:

• GitHub: repository access, on the repositories you select.
• Render and Railway: the providers your applications are actually deployed to.
• SendGrid: transactional and waitlist email delivery.
• Our hosting and database providers: for the application itself and its Postgres database.

Each of these acts on our instructions under a data-processing agreement. We will also disclose data where we are legally required to, and we will tell you if that happens unless we are prohibited from doing so.

Account data is kept while your account is open. If you delete your account, we remove your personal data within 30 days, except where we must keep records for accounting or legal reasons.

Build logs and scan findings are kept for 90 days. Secrets are deleted immediately when you remove them or delete the environment they belong to. Server logs are rotated within 30 days.

Refact requests access to the repositories you choose, not to your whole account. We read those repositories, and we open pull requests that you review. We never push to your default branch, and we never modify a repository without a pull request.

You can revoke our access at any time from your GitHub settings, which immediately stops any further analysis or deployment.

We set a session cookie when you sign in, and a CSRF token cookie to protect the sign-in form. Both are strictly necessary for the service to work, so we do not ask for consent for them.

We do not use advertising cookies or third-party tracking pixels.

Under UK GDPR you can ask us for a copy of your data, correct it, delete it, receive it in a portable format, restrict how we use it, or object to processing we base on legitimate interest. Where processing rests on consent, you can withdraw that consent at any time.

Email privacy@refact.app and we will respond within one month. If you are not satisfied with our answer, you can complain to the Information Commissioner's Office at ico.org.uk.

Some of our processors are based outside the UK. Where data is transferred, we rely on the UK International Data Transfer Addendum or an adequacy decision, so your data carries the same protection wherever it is handled.

Passwords are hashed with bcrypt, secrets are encrypted with AES-256-GCM, and all traffic is served over TLS. Access to production data is limited to the people who need it to operate the service.

If you believe you have found a vulnerability, our disclosure policy is in SECURITY.md in our public repository, and you can write to security@refact.app.

If we change this policy in a way that materially affects you, we will email you before the change takes effect. Otherwise the date at the top of this page is the authoritative version.