This Privacy Policy describes how Manifest (the "Service"), a product operated by izater ("we," "us," or "our"), collects, uses, and protects information when you run a scan, sign in with GitHub, connect a repository, or pay for a subscription, unlock, or Stack Audit.
1. What Manifest reads from GitHub
Manifest reads repository contents to build a report. Depending on which path brought you here, that happens one of three ways:
- Public quick scan. You paste a public repository's URL. We download that repository's source once, over HTTPS, to parse it. No GitHub account or sign-in is required for this path.
- Private quick scan. You sign in with GitHub through a one-time OAuth authorization scoped to reading your repositories. The resulting access token is used to fetch the one repository you select, then discarded. We do not store this token.
- The GitHub App (subscription product). You install the Manifest GitHub App on your account or organization and grant it access to specific repositories. The App requests only two permissions: repository contents (read-only) and metadata (read-only, required by GitHub for every App). It cannot open pull requests, run workflows, modify code, or access anything outside those two permissions. You can review or revoke this access at any time from your GitHub account's Applications settings.
In every case, we read repository contents to compute a report; we do not modify or write back to your repository.
2. What we store, and what we never store
A scan produces a report made up of, at most, the following:
- A dependency inventory (package names, declared and resolved versions, and whether a version is a pre-release), read from your project's dependency files (such as `package.json` and its lockfile).
- An integration map (which third-party services, such as Stripe or a database provider, appear to be wired into the codebase), matched against package names and environment variable names.
- Ownership and access signals derived from git history: which files were last touched by which GitHub login, and whether a small number of contributors account for most of the commits touching sensitive files.
- For an authenticated GitHub App installation: the installation id, which repositories it can see, and the resulting scan history for each one you activate.
- For a quick scan: a hashed version of the requester's IP address, used only to enforce a per-hour rate limit. We do not store the raw IP address.
- Billing records associated with your Stripe customer id (see Section 4).
We never store real credential values, anywhere: not in our database, not in logs, not on screen. When Manifest reads an environment variable file (`.env`, `.env.example`, and similar), it reads and reports only the variable name on the left-hand side of each line, such as `STRIPE_SECRET_KEY` — never the value assigned to it. In the one case where the scan engine legitimately encounters a real secret already committed in source code (a hardcoded credential literal matching a known key format), it stores only the provider, file, line number, and a masked preview showing a handful of leading and trailing characters, such as `sk_live_****1a2b`. The full value is discarded immediately and is never written to our database, logs, or any report you or anyone else can view.
3. How we use information
We use the information above only to:
- Generate and display the report you requested;
- Detect changes to a connected project over time and notify you about them;
- Authenticate you and maintain your session;
- Process payments and manage your subscription or one-time purchase;
- Enforce rate limits on the free public scan;
- Diagnose and troubleshoot errors in the Service.
We do not use your information for advertising, and we do not sell it.
4. Who we share information with
We share information only as needed to operate the Service:
- GitHub — every read described in Section 1 is a request to GitHub's own API, made with either your one-time OAuth token, a GitHub App installation token, or an unauthenticated public request.
- Stripe — processes every payment (subscription, one-time unlock, and Stack Audit checkout). We never see or store your card details; Stripe handles them directly.
- Neon — our database provider, hosting the Postgres database that stores everything described in Section 2.
- Vercel — our hosting provider, running the application itself.
We do not use analytics or advertising trackers, and we do not share your data with anyone else.
5. Data retention
We retain account, project, and scan data for as long as your account or a public quick scan report remains active. If you deactivate a project or uninstall the GitHub App, we stop scanning it; existing report history is retained until you request deletion. Billing records are retained as required for accounting and tax purposes.
6. Your choices
- Revoke the GitHub App's access at any time from GitHub's own Settings → Applications page, or by uninstalling it directly.
- Cancel your subscription at any time; it takes effect at the end of the current billing period.
- Request deletion of your account and associated data by contacting us (Section 9).
7. Security
Access tokens and webhook secrets are stored as encrypted environment variables, never in application code or logs. All traffic to and from the Service is encrypted in transit (HTTPS). No method of storage or transmission is perfectly secure, but we do not ask for, and structurally cannot store, more than what is described above.
8. Children's privacy
The Service is intended for software professionals and businesses. It is not directed at children, and we do not knowingly collect information from anyone under 16.
9. Changes to this policy
We may update this policy as the Service changes. We will update the "Last updated" date above when we do. Continued use of the Service after a change constitutes acceptance of the updated policy.
10. Contact
Questions about this policy or your data can be sent to manifest@izater.com.