What we see

Pharon scans your project on your machine and uploads only an inventory: a list of what your stack is made of. Run pharon show anytime to see the exact JSON that would be uploaded.

We collect

• Component names and versions (packages, runtimes, container images, CI actions, services)
• File paths of stack files (paths only, e.g. services/api/uv.lock)
• Image names, tags and digests; CI action refs
• Infrastructure-as-code resource types and literal versions
• Cloud service types, engines and versions, with hashed account and resource IDs
• Detected third-party service vendors (e.g. Stripe), from package names and .env.example variable names
• Sync metadata: repo identity, branch, commit SHA, timestamps
• Values you type in yourself (manual entries)
• Secret names (never values), only if you choose to share a /pharon:check-incident verdict with your team

We never collect

• Source code
• File contents (beyond the parsed names and versions)
• Secret values, .env values, environment variable values
• Terraform variables (*.tfvars) or state files
• Cloud data: objects, rows, secrets, parameters
• Raw cloud account or resource IDs (unless you opt in)
• Browser or terminal history

We can't harm you even if we're hacked

Incident files are signed data, never scripts. The checking logic lives in the plugin installed on your machine, which you can read. The plugin verifies every signature and never deletes files, rotates keys or changes cloud resources on its own.