Privacy notice

Publisher: Mojtaba. Support: mojtaba.zakeri@gmail.com.

Your connection

The service stores an opaque account identifier derived from the Azure-verified account and organization, an encrypted Azure personal access token, connection time, repository count, selected repository names/IDs, and access mode. Each connection belongs to its authenticated user. Tokens are encrypted with AES-256-GCM using a secret outside source code.

Authorization and sessions

The independent OAuth authorization server stores encrypted client registrations, grants, short-lived access/refresh token records, and browser-session state in PostgreSQL. A verified browser session can continue a new OAuth login without resending your Azure token; client consent is still required. Browser sessions last up to two hours, access tokens up to 15 minutes, and grants up to 30 days unless revoked earlier. Expired records are no longer authoritative; database cleanup and provider backup retention are separate. OAuth credentials are separate from your Azure token.

Repository data

Source file bodies and tool result payloads are not persisted in the application's database. Requested writes are saved in Azure. Tool results are returned to ChatGPT or Codex and may become conversation content under that host's settings.

Deletion

Disconnect deletes your application's connection record and encrypted Azure token, and revokes its OAuth authorizations. You can also revoke client authorizations separately without deleting your Azure connection. Disconnect does not revoke the Azure PAT, remove Azure changes, delete conversation history, or determine provider backup/operational-record retention. Revoke a PAT in Azure to invalidate it independently.

Hosting and support

Vercel, the PostgreSQL provider and Microsoft process hosting or API data under their policies. Do not send credentials or private source in support messages. Pricing and final commercial terms are not yet active.