Privacy Policy

RailsHealth scans your Rails applications for vulnerable gems and end-of-life runtimes. This policy explains, in plain English, what we collect, what we don't, what happens to it, and what you can do with it.

The short version: your repositories and scan data are yours. We don't sell them, share them, or feed them to anyone. You can take them with you whenever you want, and you can delete them — for real — whenever you want.

What we collect

We collect only what we need to run your account:

• Account info — your email address and (optionally) your name. Used to sign you in and to email you about your account.
• The repositories you connect — when you add a repository, you authorize RailsHealth to access it through GitHub. We read your dependency manifest (such as Gemfile.lock) and basic repository metadata — the name, default branch, and whether it's private — so we can scan it.
• Scan results — the gems and versions we find, the vulnerabilities we match against public advisory databases, your health scores, and the runtime (Ruby/Rails) versions in use. This is the data the product is for.
• Billing info for paid accounts. Payment is handled by Stripe; we don't store your card or bank details on our servers. Stripe does, under their privacy policy.
• Basic technical logs — server logs containing IP addresses and request URLs, used to keep the service running and to diagnose problems. Rotated and discarded over time.

What we don't collect

To be specific about the things we deliberately decided against:

• We don't store your source code. We read your dependency manifest to identify the gems and versions you depend on, and we keep the scan results and a checksum — not a copy of your codebase.
• No third-party analytics on what you do here. No Google Analytics, no Mixpanel, no Amplitude, nothing of that shape.
• No third-party error tracking or telemetry that includes the contents of your data.
• No AI services. Nothing in your account is sent to an AI model — not for "smart features," not for training, not for any reason.
• No advertising networks. No retargeting pixels. No ad-related cookies.

Where your data lives

Your data is stored on our servers, hosted in DigitalOcean's data centers in the United States. We don't run a copy through a third-party data warehouse. We don't replicate it to an analytics provider. It lives in our database, full stop.

What we do with what you connect

We scan it so you can see what needs attention. That's the entire purpose. We don't browse your repositories or query your data for any reason except to run the service (e.g., to scan a repo when it's scheduled, to render the page when you ask for it, to back up the database for disaster recovery, and to investigate a specific bug if you report one).

What we never do with what you connect

• We do not sell your data. Not to anyone. Not now. Not as part of any deal.
• We do not share your data with other vendors, marketing partners, advertisers, or any other third party for their benefit.
• We do not voluntarily share your data with any government agency unless legally compelled to do so.
• We do not have a back door, a proactive reporting arrangement, or any system that gives outsiders access to your data without a process going through us.

Your GitHub connection

When you connect a repository, you grant RailsHealth access through GitHub. You can review and revoke that access at any time from your GitHub account's settings, and you can remove a repository from RailsHealth whenever you like. When you remove a repository, its scan history is deleted along with it.

Government and legal requests

Like any business, if a court issues a valid subpoena or warrant for user data, we'll comply with it. We will push back on overbroad requests and require lawful process for any specific information.

If we ever receive a request that targets your account specifically and we are legally permitted to tell you, we will. If we are legally prohibited from telling you, we will challenge that prohibition where we reasonably can.

Your rights — export and delete

You can export everything in your account — your repositories and their scan history. Email support@stillriversoftware.com and we'll send it to you as standard files. We don't make you wait 30 days or jump through hoops.

You can delete your account at any time. When you do, your data is permanently and immediately removed from our database. There is no soft-delete table that retains it for 30 days. Gone is gone. We cannot recover it after deletion, even if you ask us to.

Cookies and tracking

We use a small number of first-party cookies to keep you signed in and to remember your preferences (light/dark theme, current account). We do not set advertising or third-party tracking cookies on the marketing site or inside the app.

Analytics and traffic measurement

To understand how the site and app are used, we run our own first-party, self-hosted analytics (page views and visits). This lives in our own database — it is not sent to Google Analytics or any third-party analytics product.

The one outside service this touches is geolocation. To turn a visit into a rough country or region, we send the visitor's masked IP address — the last part of the address is removed before it ever leaves our servers — to ipinfo.io, and we store only the coarse location it returns. We never send them your full IP address, and nothing you do inside your account is shared with them.

The Continuity Commitment

If anything ever happens to RailsHealth — shutdown, acquisition, anything — here's what's promised to you, and this section is part of this Privacy Policy:

1. 60 days' notice by email before any planned shutdown.
2. Full export available on request throughout the notice period (and any time before, too) — email us and we'll send you your data.
3. Your data is permanently deleted at shutdown if you don't export it.
4. If the company is ever acquired, you'll get 60 days' notice and can export and delete your account before any ownership transition. The new owner inherits these commitments.
5. Your data is never sold. Not now. Not as part of any deal. Ever.

Children

RailsHealth is not intended for use by anyone under 18. We do not knowingly collect data from minors. If you believe a minor has created an account, contact us and we'll delete it.

Changes to this policy

If we update this policy, we'll change the "last updated" date at the top and — for any change that materially affects how your data is handled — email you about it before the change takes effect. We won't change the privacy commitments above (no selling or sharing your data, hard delete, full export, the Continuity Commitment) without first giving you the opportunity to export and delete your account.

How to reach us

Email support@stillriversoftware.com. There's a real person on the other end.