Skip to content
DiffGuardian
Download

Privacy Policy

Version 8 · Last updated October 10, 2026

Effective date: 10 October 2026 · Version 8

This Privacy Policy explains how Athleon Labs Inc. ("Athleon Labs", "we", "us"), a corporation incorporated in Manitoba, Canada, handles personal information in connection with DiffGuardian — the desktop application, the website at diffguardian.ai, and the account and subscription service.

The short version

DiffGuardian is a desktop application that reviews code on your machine.

  • We do not receive, store or process your source code. There is no endpoint on our servers that accepts code, diffs or repository contents.
  • When you use your own AI provider key, your code goes directly from your machine to that provider, under your agreement with them.
  • When you use an on-device model, your code does not leave your machine at all.
  • The desktop app keeps its own working data — indexed repository text, review drafts and pull-request metadata — in a local database on your machine. See "Data the desktop app keeps on your machine" below.
  • What we do hold is an account record, a subscription record, a registration record for each device you install on, your acceptance of these policies, a record of billing events such as a completed checkout or a cancelled subscription (kept with our analytics provider under a one-way hash of your account id), and — only if you opt in — anonymous product analytics.

What we collect

Account information. When you create an account we receive your email address, and your name and profile image if your sign-in provider supplies them. Sign-in is handled by Clerk; we do not receive or store your password.

Subscription information. If you subscribe, our payment processor Stripe processes your payment. We store a customer identifier, a subscription identifier, the price you subscribed to (from which your plan tier follows), the seat quantity, subscription status, whether it is set to cancel, and the current period end. We never receive or store your full payment card details.

Organisation and team information. If you belong to an organisation, for example through a Team subscription, we keep a record of that membership: the organisation's identifier and name, your role in it, and when you joined. This record is refreshed from Clerk, which holds the organisation itself. For an organisation's subscription we also store the link between the organisation and its Stripe customer, together with the subscription details described above.

Legal acceptances. When you accept our policies we record which document and version you accepted, and the time. We do not record an IP address or user agent alongside a legal acceptance. We keep this, including after your account is deleted, because it is the evidence that an agreement was formed.

Device registration. Each installation of the desktop app creates a security key so we can recognise it on your account. We store the public half of that key together with your operating system and app version. The private half is generated on your machine, encrypted with a key held in your operating system's secure storage, and is never sent to us. We use this to keep your account secure and to withdraw access from an individual installation without affecting your other devices. We do not record your IP address for this.

Support, feedback and survey responses. Bug reports and other messages you send from the app's feedback form go to Sentry, our error-reporting provider, as user feedback — see the Sentry entry below. Star ratings and NPS ("how likely are you to recommend") responses go to PostHog, our product-analytics provider, as anonymous survey responses tied to a random per-install identifier, never to your account. We do not otherwise store either of these on our own servers. Please do not include confidential information in free-text comments.

Diagnostics and usage (opt-in). The application can send anonymous product-usage analytics (PostHog) and error diagnostics (Sentry). Error diagnostics are anonymous unless you are signed in and have opted in, in which case an error report carries your account's internal identifier — never your email address. These are engineered not to carry your code: error reports are scrubbed of token-shaped strings, URLs are reduced to their origin, home-directory paths are redacted, and crash memory dumps are never transmitted. See the Security & Data Handling page for specifics. This is the app's own analytics; it is separate from the billing-related events our servers send to PostHog directly, which are not governed by this setting — see the PostHog entry under "Who we share it with" below.

Website visitors. The marketing and documentation site uses two analytics tools.

  • PostHog runs cookieless analytics: pages viewed, which buttons and links are clicked, and device and browser type. It sets no cookies and stores nothing on your device — the identifier it uses lives only in the page's memory and is gone when you reload or leave, so we cannot recognise you across visits. We do not store your IP address with these events.
  • Google Analytics 4, provided by Google and loaded through Google Tag Manager, measures traffic to the same pages: pages viewed, how you arrived at the site, approximate location, and device and browser type. It sets first-party cookies (such as _ga) in your browser so it can recognise a returning visitor, and Google receives your IP address and browser details when the page loads. We use it only to understand how the website is used. We do not sell your personal information, and we do not use Google Analytics for advertising. You can block these cookies in your browser settings, or install Google's Analytics opt-out browser add-on.

Neither tool runs inside the desktop app or the signed-in account pages.

Website error reports. Separately from analytics, the website and its web account pages report browser errors to Sentry, our error-reporting provider, separately from the analytics above. These reports carry technical details such as the error itself, the page address, your browser and device type, and the application version. We configure them not to include your account identity, cookies, authorization headers, query-string credentials or form contents.

Data the desktop app keeps on your machine

The desktop app stores the text of the repositories you index, the reviews and draft comments you write, and metadata about the pull requests you open (titles, authors, branch names, file paths) in a local SQLite database on your machine, in your user library. That database is not encrypted by the app; it relies on your operating system's disk encryption (FileVault, BitLocker, LUKS) and your user account's file permissions, the same way your source checkout does. Provider keys and access tokens are the exception — the app encrypts those itself, using a key held in your operating system's secure storage, and they are never kept in that database. None of this data is sent to us. You can remove all of it at any time with the Erase local data control in the app's Settings, or by deleting the application's data folder.

Your own AI provider

When you configure your own provider key ("bring your own key"), your prompts — including code — go directly from your machine to that provider and are processed under that provider's terms and data-retention policy, not ours. Whether the provider retains prompts, for how long, and whether it uses them to improve its models is decided by your agreement and your settings with that provider. We do not set or override retention on your behalf, and we do not receive those prompts. Review the retention and training settings with your provider before sending confidential code.

What we do not collect

We do not collect your source code, diffs, commit contents, repository names, file paths, prompts or AI output. We do not sell personal information, and we do not use your code to train models — we have no access to it.

How we use information

  • To provide and operate the Service, including authentication and entitlement.
  • To process payments, manage subscriptions and prevent payment fraud.
  • To provide support and respond to you.
  • To keep the Service secure, detect abuse and debug faults.
  • To understand aggregate usage and improve the product.
  • To meet legal, tax and accounting obligations.

Our legal bases, where applicable law requires one, are performance of our contract with you, our legitimate interests in operating and securing the Service (including website analytics), your consent (for the desktop app's optional analytics), and compliance with legal obligations.

Who we share it with

We share personal information only with service providers who process it on our behalf, and only as needed to run the Service:

  • Clerk — authentication, identity, and account-related email (sign-in, verification, security notices).
  • Stripe — payments, subscription billing, and billing-related email (receipts, invoices, and payment notices).
  • Vercel — application hosting.
  • Neon — the database holding account records, and short-lived rate-limit counters keyed to your account identifier or a one-way hash of your IP address, never the address itself.
  • Sentry — browser error reports from the website and web account pages (see "Website error reports" above), and error diagnostics (carrying your account's internal identifier, never your email address, when you are signed in and have opted in), and any bug report or other message you choose to send from the app's feedback form (your message text and, if you are signed in, your account email address, so we can reply). Neither is removed when you delete your account — see Retention below.
  • PostHog — the app's own product analytics (only if you opt in), and the star ratings and NPS responses you submit from the app. Those are sent when you submit them regardless of the analytics setting, because submitting an answer is the action itself, and they are tied only to a random per-install identifier, never your account. Separately, our servers send PostHog billing lifecycle events (for example, a completed checkout or a cancelled subscription) whenever they happen — this is not governed by the in-app analytics setting. The identifier attached to those events is pseudonymous, not anonymous: a one-way hash of your account id, or, for an organisation's billing event that no member triggered, a fixed system identifier, filed under your organisation as a PostHog group. Some of these events also carry your organisation id in the clear, and may carry a Stripe customer, subscription or invoice reference, your plan tier and billing interval, or a seat quantity or member count — never a dollar amount. A few also carry a short fixed label, such as why a chargeback happened, or a count, such as how many duplicate subscriptions were found — never free text you wrote.
  • Google — website traffic analytics (Google Analytics 4, loaded through Google Tag Manager) on the marketing and documentation site only. Google acts as our service provider for this measurement; we do not sell personal information to Google or to anyone else.
  • Cloudflare — content delivery and application downloads.

Model providers you configure yourself are not our processors: you send data to them directly, under your own agreement with them.

We may also disclose information where required by law, to enforce our terms, to protect rights and safety, or in connection with a merger, acquisition or sale of assets — in which case we will give notice before your information becomes subject to a different policy.

International transfers

We are based in Canada and our providers operate in Canada, the United States and the European Union. Where personal information is transferred across borders, we rely on the provider's contractual safeguards, including standard contractual clauses where applicable.

Retention

We keep account records while your account is active and for a reasonable period afterwards. Device registrations are deleted along with your account, as described below; deregistering a single device marks it revoked but does not delete its record before then. Legal-acceptance records are kept after your account is deleted, as evidence that the agreement was formed. Each record holds only the document, its version, the time you accepted it, and your account's internal identifier; after deletion that identifier is linked to nothing else we hold except the record that the account was deleted. Subscription and billing-history records are kept for as long as needed for legal, tax and accounting purposes, including after your account is deleted. Diagnostic data is kept on a rolling short-term basis. Ratings, NPS responses and feedback-form messages are not retained on our own servers at all; each is subject to the retention policy of the provider it was sent to (PostHog or Sentry, respectively). Deleting your account removes your account record, your device registrations and your organisation memberships, and, on a best-effort basis, the PostHog record filed under the pseudonymous identifier used for the billing events described above. It keeps your legal-acceptance records, your subscription and billing-history records, for the reasons above. It does not remove feedback-form messages already sent to Sentry, including the account email address attached to them, or error reports tagged with your account's internal identifier; both follow Sentry's retention period, and you can ask us to have them removed by contacting us at support@diffguardian.ai.

Your rights and choices

Depending on where you live, you may have the right to access, correct, delete, or export your personal information, to object to or restrict certain processing, and to withdraw consent.

  • Delete your account from within the application at any time. This deletes your account record from our systems.
  • Export your data from within the application (Settings → Account). The export is a machine-readable JSON file of every record we hold about your account.
  • Turn analytics off in Settings. Optional analytics are consent-based and can be withdrawn at any time.
  • Contact us at support@diffguardian.ai to exercise any other right. We will respond within the time required by applicable law.

If you are in Canada and are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada. If you are in the EEA or UK, you may complain to your local supervisory authority.

Children

DiffGuardian is not directed to children and is not intended for use by anyone under the age of majority in their jurisdiction without the consent of a parent or guardian. We do not knowingly collect personal information from children.

Security

We describe our technical and organisational measures in Security & Data Handling. No system is perfectly secure, but the strongest protection here is architectural: the data most sensitive to you — your code — is never sent to us in the first place.

Breach notification

If we become aware of a breach of security that affects your personal information, we will notify you at the email address on your account within 72 hours of confirming it, and any regulator within the time applicable law requires. The notice will say what happened, what information was involved, what we have done, and what you can do.

Data processing agreement

If your organisation needs a data processing agreement (for example under GDPR Article 28 or the UK GDPR), email support@diffguardian.ai and we will provide our standard DPA for signature. The subprocessor list above is the list that agreement incorporates.

Changes

We may update this policy. Material changes will be published with a new version number and effective date, and we will seek your acceptance where required.

Contact

Athleon Labs Inc., Manitoba, Canada — support@diffguardian.ai