Privacy policy

Pharon (getpharon.com) is a product of GITMORE LTD, a company incorporated in England and Wales (company number 16606931) with its registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom ("Gitmore", "we", "us"). Gitmore is the data controller for the personal data described here. Questions and requests: support@gitmore.io.

Your account. Your email address and name, the organizations you belong to and your role in each, invitations, and an audit log of actions taken in each organization. Sign-in links and codes, sessions and CLI tokens are stored as hashes.

Your stack, from the plugin and CLI. Only an inventory leaves your machines:

• Component names and versions (packages, runtimes, container images, CI actions, services)
• File paths of stack files (paths only, e.g. services/api/uv.lock)
• Image names, tags and digests; CI action refs
• Infrastructure-as-code resource types and literal versions
• Cloud service types, engines and versions, with hashed account and resource IDs
• Detected third-party service vendors (e.g. Stripe), from package names and .env.example variable names
• Sync metadata: repo identity, branch, commit SHA, timestamps
• Values you type in yourself (manual entries)
• Secret names (never values), only if you choose to share a /pharon:check-incident verdict with your team

We never collect:

• Source code
• File contents (beyond the parsed names and versions)
• Secret values, .env values, environment variable values
• Terraform variables (*.tfvars) or state files
• Cloud data: objects, rows, secrets, parameters
• Raw cloud account or resource IDs (unless you opt in)
• Browser or terminal history

Settings you give us. Domains whose public DNS we check, Slack webhook URLs, webhook endpoints and redaction rules.

Billing. Paddle handles payment and gives us your subscription's plan and status and a customer reference. We never see your card details.

Request logs. Our servers keep standard technical logs (such as IP address and browser) for security and troubleshooting.

• To run Pharon: match incidents against your inventories and alert the people you choose. This is necessary to perform our contract with you.
• To keep accounts and the service secure, prevent abuse and fix problems: our legitimate interest.
• To bill you through Paddle, and to meet legal and tax obligations.
• To send service emails: sign-in links, alerts, digests and notices about your account. We don't send marketing emails without your consent, and we don't sell your data.

Pharon uses only the cookies it needs to work, all first-party: your session, the organization you picked, the check that a sign-in link opens in the browser that asked for it, and the two-factor step. No advertising or analytics cookies, and no tracking scripts.

Service providers that process data for us, under contracts that require them to protect it:

• Paddle: payments, invoicing, tax and refunds, as Merchant of Record
• Resend: sending email
• MongoDB Atlas: our database
• The hosting provider that runs our servers

We also send data where you ask us to: alerts to your Slack workspace and webhook endpoints. We disclose data when the law requires it. Some providers process data outside the UK; where they do, we rely on safeguards such as the UK International Data Transfer Agreement or the EU Standard Contractual Clauses.

• Account and organization data: while your account exists.
• Inventory history: as long as your organization chooses (30 to 365 days, 90 by default). Each project's current inventory is kept while the project exists.
• Sign-in links and codes: 15 minutes. Sessions: 14 days. CLI logins: until revoked, or 90 days without use.
• Billing records: as long as tax law requires, by Paddle and by us.

When you ask us to delete your account or organization, we delete its data within 30 days, apart from what the law requires us to keep. Write to support@gitmore.io.

Under UK and EU data protection law you can ask for a copy of your data, correct it, delete it, restrict or object to its use, and take it elsewhere. Write to support@gitmore.io; we answer within a month. You can also complain to the UK Information Commissioner's Office (ico.org.uk) or your local authority.

Traffic is encrypted in transit. Secrets and tokens are stored hashed, notices are signed, two-factor authentication is available, and the plugin never sends source code or secret values. No system is perfectly secure, but we'll tell you without undue delay if a breach affects your data.

Pharon is a tool for software teams and isn't meant for anyone under 16. We don't knowingly collect their data.

We'll post changes here with a new date, and tell you by email or in the app when they're significant.