Privacy Policy

Who we are

Sentrint is operated by Gourab Dasgupta, a sole proprietor based in Kolkata, West Bengal, India. For the personal data you give us about yourself, we act as the Data Fiduciary and you are the Data Principal. Where your code contains personal data about other people, you are the Data Fiduciary and we simply process it on your instructions to run the scan.

What we access

Signing in asks for your email address and nothing else. No repository permission is requested at sign-in, and a public repository can be scanned on that alone.

To scan a private repository you install Sentrint on GitHub and choose which repositories it can see. Sentrint asks GitHub for two permissions on those repositories, both read-only: Contents, to clone the code for the scan, and Metadata, which GitHub requires alongside it. We request no write permission of any kind, so we cannot push, open pull requests, change settings or add keys, and this is enforced by GitHub rather than promised by us. Access reaches only the repositories you selected, and you can change or remove it at any time from your GitHub installations page.

How we handle your code

• Your source is fetched into an ephemeral, isolated environment only for the duration of a scan.
• It is deleted the moment the scan finishes. We do not retain, back up, or train any model on your repository.
• We keep only scan output: findings (rule, file path, line, severity), your security score, and the commit SHA scanned, so you can see your history.
• For critical and high findings only, we also keep a short code excerpt, about ten lines either side of the finding, because that is what builds your fix prompt after the scan files are gone. We never keep an excerpt for a leaked credential or for a lockfile, and excerpts are deleted along with the scan.
• We keep a list of the third-party components your project depends on, read from your lockfiles: package name, version and licence, in the standard CycloneDX format. This is your Software Bill of Materials, and it is the one thing about a scan that has to outlive the scan, because it is what you hand to a customer or a regulator who asks what your software is built from. It contains no source code of yours, only the names and versions of other people's published packages. It is deleted along with the scan.

One exception you should know about: checking whether a leaked key is still live

When we find something that looks like a credential in your code, we check whether it actually still works. A revoked key is a very different emergency from a live one, and we don't want to make you panic-rotate a key that was already dead.

The only way to know is to ask the service that issued it. So for a suspected credential, our scanner sends that candidate credential value to the provider it appears to belong to, such as AWS, Stripe or GitHub, purely to ask "is this still valid?" We do not send your code, and we never store the credential value itself. If it comes back live, we mark it critical; if not, it stays informational.

We're calling this out plainly because it is the one place where something from your repository is sent to a company that isn't in our provider list below. This check runs on every scan, including scans on the free plan, and it cannot be switched off. If you would rather it never happened, don't scan a repository whose secrets you are not willing to have verified. Either way, treat any credential that has been committed to git as compromised and rotate it.

Account data we store

From your GitHub profile we store your GitHub ID, username, email and avatar URL, used to identify your account and send essential account communication. Nothing more. We never store your GitHub password; access tokens are held encrypted, solely to operate the Service.

We may also maintain access logs, audit logs, authentication logs and other security records to operate, secure and improve the Service, investigate fraud, abuse or security incidents, comply with applicable law, and enforce our Terms of Service.

Country, for pricing. Cloudflare, which sits in front of this site, tells us the two-letter country code for your connection. We use it for one thing: deciding whether you see rupee or dollar prices. We do not store it against your account, we do not send it to any third party, and it is a country only, never a city, an address or a coordinate. Your IP address is not shared with anyone to work this out, because Cloudflare is already handling your request.

Why we process your data & your consent

By signing in and accepting our Terms, you give your free, specific, informed and unambiguous consent (Section 6, DPDP Act) for us to process your personal data to: create and secure your account; run scans and produce reports; take payment; provide support; and keep the Service secure.

You can withdraw that consent at any time. Today the route is deleting your account in Settings, or writing to our Grievance Officer below if you want something narrower withdrawn. Withdrawing does not undo processing already carried out lawfully. Alongside consent, we may process personal data where it is reasonably necessary to provide and secure the Service, comply with applicable law, prevent fraud or abuse, protect our rights, or enforce our Terms of Service.

Who we share data with

We share the minimum necessary data with a small set of service providers. Every one of them is named below, in the order a scan reaches them. Your data export in Settings names them too, and Terms §6.4 is the full table with a column for exactly what each one receives.

• Cloudflare: DNS, content delivery and the firewall in front of this site. It sees the request, including your IP address, before we do.
• GitHub: sign-in and repository access.
• Upstash: the queue your scan waits in, and the rate limits that keep the site up. Job identifiers, not code.
• Google Cloud: runs the application, runs each scan in its own sealed job, and carries our outgoing email.
• OpenRouter: the route the AI request takes. Relevant code snippets and findings pass through it on the way to the model, with data collection denied on every request.
• Anthropic: the model that writes the fix suggestions and explanations, reached through OpenRouter on zero-retention endpoints only. Nothing sent is stored by, or used to train, a third-party model.
• Supabase: the database holding your account and your findings.
• Dodo Payments: takes payment. They are the legal seller of record and issue your invoice. We never see or store your full card details.
• Sentry: diagnostic logs when something breaks, with personal identifiers disabled.
• PostHog, our product-analytics provider: which pages you visit, which actions you take in the app, the site you arrived from, and the country your visit came from, so we can see what people look for and where the product is confusing. This runs on our public pages as well as inside the app. No email, username or raw IP address. We do not record your screen or your session, we do not record what you type, and we do not set an analytics cookie. If you are not signed in, you are counted and not profiled.

Two more receive something narrower than the ten above, so they are set out separately rather than folded in.

• OSV (api.osv.dev, run by Google and the Open Source Security Foundation): the public vulnerability database we check your dependencies against. It receives package names and versions read from your lockfile. Never your source code.
• The provider that issued a key we found: when the scanner finds what looks like a live credential, it asks that provider, and only that provider, whether the key still works. It is the difference between "you leaked something" and "you leaked something that still opens the door". The candidate key is all that is sent, we do not store it, and Terms §6.11 sets out the whole check.

The ten named companies are on the homepage too, in the same order. A test fails our build if the lists stop matching, so a provider cannot be added to one and quietly left off the other.

We do not sell, rent, license or otherwise monetise your personal data. We do not use it for behavioural advertising, cross-context behavioural advertising, cross-site tracking or any similar advertising or marketing purpose. The product analytics described above exist so we can see how the app itself is used, and nothing more.

If you're outside India

Sentrint is run from India, so Indian law, principally the DPDP Act, is the law we answer to. You are welcome to use it from anywhere, and we don't run a second-class version of privacy for people whose country doesn't force our hand:

• The rights on this page are for everyone. Access, correction, erasure and grievance work the same whether you're in Bengaluru, Berlin or Boston, and most are buttons in Settings rather than requests you have to make.
• If you're in the EU, UK or another region with its own data law (GDPR and its relatives), write to our Grievance Officer below with what you want and we'll do it. The "GDPR-aligned" mark on our site is a statement about substance, not a certificate: we have not appointed an EU representative and we are not claiming formal GDPR certification. What it means is that your access, correction and deletion rights are honoured wherever you are.
• Your data leaves India, because our providers are global (see the list above). Under Indian law we rely on Section 16 of the DPDP Act and apply reasonable safeguards, and we will not transfer data to a country the Indian government restricts.
• The currency you pay in follows where you are. Visitors in India see rupee prices and are billed in rupees; everywhere else sees dollar prices and is billed in dollars. Rupee and dollar prices are separate price points rather than a live conversion, so the two are not the same amount. Your card issuer may add its own charges on top. How we work out where you are is described under Account data we store.

Cookies

We use a single, signed session cookie to keep you logged in. No third-party advertising or tracking cookies.

Our analytics service keeps a small identifier in your browser's local storage, not a cookie. It is set on our public pages as well as inside the app. Correcting an earlier version of this page, which said signed-in pages only: that stopped being true on 9 August 2026 and this section had not caught up.

If you are in the EEA, the UK or Switzerland, we ask before we store anything, and nothing is written until you say yes. Decline and the analytics script is never loaded at all, so there is nothing left running in the background to opt out of afterwards. The only thing we keep in that case is the fact that you declined, so we do not ask again on every page. Accept and Decline are the same button, the same size, in the same place, because a choice where one answer is easier than the other is not a choice.

Elsewhere, including India, analytics runs without an interstitial. It is page views only, and everything in the PostHog entry under Who we share data with applies wherever you are.

Changing your mind, wherever you are. The button below reopens the choice for everyone, not only for readers in the regions above. Decline after having accepted and we stop capturing and drop what was stored, on the spot.

Change my analytics choice

Data retention & deletion

We keep your account data and scan output while your account is active. When you delete your account, we delete or anonymise your records within a reasonable period (targeted at 30 days), except where the law requires us to keep something. Your repository is never retained after a scan. It is cloned into an isolated job and deleted when that job exits. There is one exception, and it is worth stating precisely: where a scan finds a critical or high severity issue in your own code, we save a short excerpt of that code, up to ten lines either side of the line concerned, so that the fix guidance for that finding can be rebuilt later without asking you to hand the file over again. No excerpt is ever taken from a finding that exposed a secret. Excerpts are deleted automatically after 30 days, and you can erase the ones we hold at any time from Settings. Export anything you want to keep before deleting.

How we protect your data

We apply reasonable security safeguards: encrypted tokens, sandboxed scanning, and access controls. No method of transmission or storage is ever completely secure, but we work to keep the data we hold to a minimum.

If something goes wrong

In the event of a personal data breach, we will notify the Data Protection Board of India and affected users in the manner and within the timelines required by the DPDP Act and its rules.

Your rights

As a Data Principal under the DPDP Act, you can:

• Access a summary of the personal data we hold about you;
• Correct, complete or update it;
• Erase it (by deleting your account);
• Nominate another person to exercise your rights if you die or become incapacitated; and
• Raise a grievance with us (see below).

These are buttons, not promises. In Settings you can:

• Download everything we hold as a JSON file, under Privacy & data: profile, every scan and finding, usage, payments, support messages, and the named list of companies your data passes through. No request, no waiting on us.
• Correct the address we reach you at, under Account, which matters if GitHub keeps your email private.
• Delete your account, under Danger zone, which erases your data and immediately cancels any subscription. We retain invoices, payment records and related financial information for the period required by applicable tax, accounting and legal obligations.
• Sign out of every device at once, under Security.

Nomination, and anything else above, goes through the Grievance Officer below.

Children

Sentrint is not directed at children. You must be at least 18 to use it, and we do not knowingly create accounts for, or process the data of, anyone under 18.

Legal disclosures

We may disclose your personal data where required by applicable law, court order or a lawful request from a governmental, regulatory or law enforcement authority, or where reasonably necessary to enforce our Terms of Service, investigate fraud or security incidents, or protect the rights, safety or security of Sentrint, our users or others.

Changes to this Privacy Policy

We may amend or update this Privacy Policy from time to time to reflect changes in our Service, applicable law, regulatory requirements or business practices. The updated version will be published on this page together with its effective date and supersedes all prior versions. Where required by applicable law, we will give you additional notice or obtain your consent before any material change takes effect. Continuing to use the Service after the effective date of a revised Privacy Policy means you accept it.