Privacy Policy
Last updated: July 21, 2026
Drydock ("Drydock," "we," "us," or "our") is operated by Individual Entrepreneur (Индивидуальный предприниматель) Trubitsyna Irina Yuryevna, registered in the Russian Federation ("we," the "Operator"). Registration details (INN/OGRNIP) will be added here once issued.
This Privacy Policy explains what data Drydock collects when you use our website, API, Telegram bot, and GitHub App (together, the "Service"), why we collect it, who we share it with, and what control you have over it. It is written to match exactly what the Service technically does today — not aspirational promises.
If you have questions or want to exercise any right described below, contact us at aiagent2046@gmail.com.
1. The short version
- We do not ask for your name, email, or a password. There is no traditional account signup. Your "account" is an opaque API key generated after payment.
- We do not store your source code. When you run an audit, your code is processed in memory to produce a list of findings (issue descriptions, file paths, line numbers). The code itself is not written to our database, and for zip uploads, it is never written to disk at all.
- Parts of your code are sent to a third-party AI model for analysis. This is the core of what Drydock does, and we want to be explicit about it — see Section 3.
- We do not currently have a self-service "delete my data" button. Email us and we will act on your request manually (see Section 7).
2. What we collect
2.1 Information you provide directly
| Data | When | Why |
|---|---|---|
| A public GitHub repository URL, or a zip file you upload | When you request an audit | To read your code and run the audit |
| Your Telegram user ID and chat ID | If you pay via Telegram Stars, or subscribe to Continuous Monitoring via Telegram | To deliver your API key or findings by Telegram message, and to let you recover your key later (/mykey, /link) |
| Payment identifiers (a Telegram Stars charge ID, a PayPal order/capture/subscription ID, or an on-chain USDT transaction ID) | When you pay | To confirm your payment and grant access. We never see or store your card number — Telegram, PayPal, or the blockchain handle that directly. |
We do not collect your name, email address, physical address, or a password, under any current payment method.
2.2 Information generated by using the Service
| Data | Description |
|---|---|
| Audit findings | For each audit: a score, and a list of findings — each with a file path, line number, a short title, an explanation, and (for secret findings) a masked preview (e.g. AKIA****(20 chars)) rather than the actual secret value. |
| Repository / pull request URLs | If you audit a public GitHub URL, or Drydock opens a Fix Pack pull request, we store that URL. This indirectly reveals the GitHub account that owns the repository. |
| API key | A random key is generated for your account; we store a salted hash of it, not the key itself, so we cannot recover a lost key for you (only you hold the plaintext). |
2.3 What we automatically log
- Your IP address is used momentarily, in memory, to enforce rate limits (so one visitor can't overload the Service). It is not written to our database.
- We do not use cookies. Your browser locally stores a theme preference (light/dark) and, for the duration of your browser tab, your API key and the current audit's result — this data lives only in your browser and is never sent to us as "analytics."
3. Your code and third-party AI analysis — the most important part
When you request an audit, Drydock does not send your entire repository to anyone. Here is exactly what happens:
- Your code is read into memory (from the zip you uploaded, or downloaded from the public GitHub URL you gave us). It is never written to disk during this step.
- We filter out irrelevant files (e.g.
node_modules/,.git/, build output) and keep only source-code file types relevant to the audit's rubric (currently authentication and general security). - From what remains, only files whose path or content match security-relevant keywords are selected for deeper analysis.
- Each selected file is truncated to a maximum size, and the total amount of code sent for one audit is capped, before being sent to a large language model for analysis.
- The model's response — the findings — is what we store. The literal code snippets used to double-check a finding (an internal verification step) are discarded and never saved to our database.
Who receives these code fragments: Drydock uses AITunnel (an LLM API proxy) as its primary provider, with a direct Anthropic API connection as a fallback. Both process the code fragments solely to generate the audit response; we do not control or have visibility into their own data-retention policies beyond what they publish themselves, and we encourage you to review them if you have specific requirements.
Practical implication: if your code contains a live secret (an API key, password, etc.), that secret's value is included in the fragment sent to the AI model for detection purposes, but is never stored by Drydock afterward — only a masked preview is kept. If you find a real secret in an audit, treat it as compromised and rotate it, independent of anything Drydock does or doesn't store.
If this data flow is not acceptable for your use case (e.g. a private, highly sensitive codebase), do not use Drydock to audit that code.
4. Who else we share data with
| Recipient | What they receive | Why |
|---|---|---|
| Supabase (database host) | All data described in Section 2 | Stores our application database |
| AITunnel / Anthropic | Code fragments described in Section 3 | Runs the AI analysis |
| GitHub | A repository URL (to fetch public code); if you install our GitHub App, installation tokens are used to open a Fix Pack pull request on your behalf | Reading your code; opening a fix PR |
| Telegram | Your Telegram identifiers, payment confirmations, and messages we send you | Payment and notification delivery |
| PayPal | Order, capture, and subscription identifiers | Payment processing |
| TRON network / TronGrid | Nothing from you directly — we only read incoming transactions to our single public receiving address | USDT payment confirmation |
| Timeweb (server host, Russia) and Vercel (frontend host) | Whatever passes through our servers in the normal course of operating the Service | Hosting |
We do not sell your data, and we do not share it with anyone for advertising purposes.
5. How long we keep data
Audit results, payment records, and subscription records are currently kept indefinitely — we do not yet have an automatic deletion schedule. Temporary working directories used to build a Fix Pack, and preview environments, are deleted automatically (previews expire and are cleaned up on a schedule; typically within hours).
We are working toward formal retention limits; until then, you can request deletion manually (Section 7).
6. Your rights
Depending on where you're located, you may have rights under laws like the GDPR (EU/EEA), UK GDPR, or similar regimes, including the right to access, correct, or delete your data, and to object to or restrict certain processing. Because Drydock does not collect your name or email, most of what we hold about you is tied to your API key, your Telegram identifiers, or a repository URL — tell us which one when you contact us, so we can locate the right records.
Right to erasure: we do not currently offer a self-service deletion button. If you email us at aiagent2046@gmail.com and identify your API key (or the Telegram/payment identifier tied to your data), we will delete the associated records within 30 days, except where we are required to keep payment records for tax or legal reasons.
Right to access: email us and we will tell you, in writing, what records we hold tied to the identifier you provide.
7. Contact
For any question about this policy, or to exercise the rights above, email aiagent2046@gmail.com.
8. Children
The Service is not directed to children, and we do not knowingly collect data from anyone who has not reached the age of consent required to enter into a payment transaction in their jurisdiction. Payment providers (Telegram, PayPal) apply their own age checks.
9. Changes to this policy
If we change how we collect or use data, we will update this page and change the "Last updated" date above. Material changes will be highlighted on the site.