Privacy

When you use Tight Code, the following is recorded in our database:

• Your account. The email address, name and Google account identifier supplied by Google when you sign in. We use Google sign-in only; we never see or store a password.
• Review records. For each review: the repository identifier, the commit references being pushed, the risk tier, which engines ran, which models they resolved to, token counts, durations and cost, and, when a review is skipped, the reason it was skipped.
• Push outcomes. When a push ends without a review (for example the repository is ignored, the account has no access, or the change had nothing to review), what happened, the repository identifier, which Mac pushed and its tightcode version.
• Findings and your decisions. Each finding's title, description, file path and line range, plus whether you fixed, dismissed or marked it a false positive, and any reason you wrote.
• Machine reports. For each Mac signed in to your account: its name, operating system and chip type, the versions of tightcode, Claude Code, Codex and Codex Security, whether Claude Code and Codex are signed in, whether the git hook is installed, and the result of the last tightcode doctor check, including its messages. This is what the Setup page shows, so you can see which Mac needs attention. A copy is kept once a day, so changes over time can be seen.
• Your email setting. Whether you get emails about changes to the app, and how you last changed it (in Config or with an unsubscribe link).
• Your data permission. Whether you have let us look at your account's detail, each time that changed and who changed it, and a record of every look at that detail (described below).
• An API key, only if you provide one. Stored encrypted in Supabase Vault rather than in an ordinary table. See below.
• Subscription state. Whether your account is active, when that changed, whether a checkout you started was finished, and the identifiers our payment processor uses to tell us so. Card details are handled by the payment processor and never reach us.

• Your source code. Reviews run on your own machine against your local diff. Only the findings and the metadata above are sent to us. We do not receive, and cannot reconstruct, your repository.
• Detected secrets. A deterministic secret scan runs before any AI reviewer is invoked, and anything it matches is redacted out of the diff. A detected secret reaches no AI engine and no database record. Finding text is redacted again at the point it is saved.
• Your subscription logins. When the engines run on your Claude or ChatGPT plan, they use the sign-in already on your machine. Those credentials are never collected, transmitted to us, or stored by us. API keys are different, and are covered below.

Findings do quote short excerpts of your code where an engine needed to explain itself. If you would rather a file never be looked at, review exemptions let you exclude it; the secret scan still covers it.

You do not have to. The engines run on your own plan logins by default, and those never leave your machine. But you can choose to run reviews on an API key instead, and the Analysis Copilot requires one, so this is the one credential we may hold.

A key you enter in the dashboard is stored encrypted in Supabase Vault, not in our ordinary database tables, and is readable only by your own account. A key used for reviews is fetched by the Tight Code software on your Mac at the moment a review runs, held in memory, handed to the review engines there, and never written anywhere else.

The Analysis Copilot works differently, because it runs on our server rather than on your Mac. Its key is decrypted on our server for each question you ask, sent to Anthropic with that question, and never logged or written anywhere else.

You can clear or replace either key at any time from the screen you entered it on, which deletes the stored secret outright. Deleting your account deletes every key it holds.

This is the most important thing to understand about how Tight Code works. The review engines are your own installations of Claude Code and OpenAI Codex, running locally under your own accounts. Your code goes from your machine to those vendors directly, governed by whatever agreement you already have with them.

Tight Code does not sit in that path, does not proxy it, and does not pay for it. The one exception is the Analysis Copilot, an optional feature that answers questions about your own review history; it runs on an API key you supply, and only when you use it.

• Supabase hosts the database and handles sign-in.
• Vercel hosts the dashboard.
• Stripe processes subscription payments and, as the seller of record through its Link service, collects the tax that applies and sends your receipts. We never see your card number.
• Resend delivers our emails, using your email address and name only to send them.

We do not sell your data, and we do not share it with anyone beyond the processors above.

The people who run Tight Code can reach the database that holds the records above. That access is used for these purposes only:

• Running the service. Keeping reviews, sign-in, billing and the dashboard working, and fixing them when they break.
• Support. When you ask us for help, we can see the state of your account: your subscription, your Macs and their versions, and how many reviews ran or failed. Anything that names a repository, a file or a finding needs the permission described below. Asking for help is not enough on its own.
• Security and abuse checks. Looking into a suspected breach of the terms, misuse of the service, or a problem with the security of your account.
• Improving the product from totals. We look at counts and rates across all accounts: how many reviews ran, failed or were skipped, which versions of tightcode are in use, how often a kind of finding is marked a false positive, and what reviews cost and how long they take. Where a failure recorded a reason, we see that reason, in the same words your dashboard shows you. These totals show no repository names, file paths or finding text.

Detail only with your permission. Sometimes the detail behind a total is what shows us how to improve: the titles of findings that were marked false positive, the file paths they were raised on, and the names of the repositories involved. We look at that detail only for accounts that have given permission. It is off by default. You can turn it on or off at any time on the Privacy tab in Config, or by writing to us, in which case we record when and how you told us. Without an active subscription, you can still turn it off on the page you land on after signing in. Turning it off stops any further look straight away. The detail never includes your source code, which we never receive, or a detected secret, which is redacted before anything is saved.

Every look at an account's detail is recorded: who looked, which account, what was opened, and when. You can see the list for your own account on the same Privacy tab.

Every record is tagged with the account that owns it, and the database enforces that boundary itself through row-level security rather than relying on application code to remember. When one customer asks for another customer's data, the database refuses and the answer is empty. The operator access described above is the only way across that boundary, and it is used only for the purposes listed there.

Review history is kept while your account has access, because its value is cumulative: your past decisions are what stop the engines raising the same rejected finding again.

If you cancel or a payment lapses, nothing is deleted straight away. Your data waits for six months after your access ends, in case you come back. After six months without access, we delete the account and everything attached to it, including any stored API keys.

If we end an account for a breach of the terms, we may delete it along with everything attached to it, including any stored API keys.

When an account is deleted, for either reason, we keep the record of its past payments, with no account attached, because we need it for accounting and tax. Stripe keeps its own record of your payments under its own privacy policy.

You can ask us to delete your account and everything attached to it at any time, and we will. Write to tightcode@poweryourprocess.ai.

We send email only about your account and about the app itself, never marketing.

• About your account, always. A welcome when you get access, a note when access ends with how to remove Tight Code from your Mac, and a notice when this policy changes in a way that affects you.
• About changes to the app, unless you turn them off. A short email when something changes that you will notice. They are on by default. Turn them off with the one-click unsubscribe link in any of them, or on the Privacy tab in Config.

If this policy changes in a way that affects what we collect or who receives it, the date at the top changes and we will tell account holders.

Tight Code is operated by Power Your Process AI. Questions about any of this go to tightcode@poweryourprocess.ai.