Dev30 uses GitHub evidence to explain work. Private access stays explicit.

1. Information Dev30 processes

GitHub identity and authorization

When you connect GitHub, Dev30 receives your GitHub user identity and an authorization credential required to access GitHub on your behalf. Hosted credentials are kept server-side and are not placed in browser-accessible storage.

Public GitHub activity

For a fresh analysis, Dev30 may collect public repository metadata, commits, pull requests, changed-file metadata, languages, dates, and URLs needed to reconstruct recent work and attach evidence to material claims.

Private repository activity

Private repositories are not included by default. Private analysis requires a connected GitHub account, an explicit private-analysis choice, appropriate repository authorization, and a Dev30 Pro entitlement. Selected private work metadata may be stored in your workspace and may be sent to the configured AI provider for explanation.

Workspace and product data

Dev30 stores data needed to provide the service, including session identifiers, saved snapshots, stakeholder reports, usage/quota records, schedules, delivery receipts, and billing-entitlement state.

Billing and email data

If paid billing is activated, RevenueCat and Paddle process subscription and transaction information. Dev30 reads subscription entitlement state rather than storing payment card details. If you configure weekly email delivery, Dev30 stores the destination email address and delivery status needed to send the update.

2. How Dev30 uses information

• Authenticate your workspace and call GitHub with the access you authorized.
• Collect evidence and generate public or private work briefings.
• Save snapshots and compare meaningful changes over time.
• Enforce Free/Pro features and monthly usage limits.
• Generate stakeholder reports and run scheduled updates you enable.
• Operate, secure, debug, and measure the cost and reliability of the service.

3. Service providers

Dev30 currently relies on third-party services for specific processing tasks: GitHub for source evidence and authentication; Netlify for hosting/runtime; Supabase for hosted persistence; DeepSeek for AI explanation; RevenueCat and Paddle for subscription state and billing when activated; and Resend for email delivery when enabled.

Each provider processes data under its own terms and privacy commitments. Dev30 aims to send only the information reasonably required for the feature being used.

4. AI processing

GitHub evidence remains the source of truth. Dev30 uses DeepSeek to explain selected evidence and produce a readable briefing. The product is designed to constrain material report claims to collected evidence identifiers, but AI output can still be incomplete or inaccurate and should be verified against the linked evidence.

Dev30 does not intentionally use the product to create hiring scores, talent rankings, permanent personality judgments, or unsupported claims about a developer.

5. Retention and deletion

Snapshots, reports, schedules, usage records, and related workspace data may remain stored so Dev30 can provide history and recurring features. Disconnecting GitHub ends the current session but does not automatically erase previously saved snapshots or reports.

Until self-service deletion is added, requests concerning stored Dev30 data can be initiated through the operator’s GitHub profile. Do not include secrets or private repository content in a public message.

6. Public reports and sharing

Saved public reports may be available through public Dev30 URLs. Private evidence is not intended to be exposed through public stakeholder-sharing routes. You are responsible for checking a report before sharing it externally.

7. Security

Dev30 uses HTTPS in production, server-side secrets, opaque session cookies, encrypted persisted GitHub credentials, RLS-protected Supabase tables, and service-role-only server access for hosted storage. No internet service can guarantee absolute security.

8. Your choices

• Do not connect GitHub if you only want to read existing public reports.
• Leave private repository analysis disabled unless you intentionally want private context included.
• Restrict the GitHub App installation to selected repositories.
• Disconnect GitHub to end the current hosted session and disable future actions that require that session.
• Cancel a paid subscription through the billing management flow when commercial billing is active.

9. Changes to this policy

Dev30 may update this policy as the hosted product, providers, or legal obligations change. Material changes will be reflected by updating the effective date on this page.

10. Contact

Dev30 is built and operated by hstptcn5. A dedicated commercial support/privacy email will be added before broad paid launch. Until then, use the GitHub profile to initiate contact without posting sensitive information.