Privacy
Policy

1. Scope

This policy explains how Hearro Technology (“we”) collects, uses, stores, and deletes information when you use FlowPreflight, a repository analysis and production-readiness review service. FlowPreflight is not a security certification and does not guarantee that a project is safe to deploy.

2. Information we process

• Repository input — source archives or public repository URLs, file paths, code, configuration, dependency metadata, and evidence required for analysis.
• Run data — generated flow graphs, findings, unknowns, reports, prompt packs, status, timestamps, and an anonymous access-key hash.
• Technical data — IP address, browser and device information, request logs, error diagnostics, and security events.
• Local browser data — recent run links may be stored in localStorage; an HttpOnly, SameSite=Strict cookie may preserve access to an active run.

3. How we use information

We use information to isolate and process analysis runs, reconstruct critical application flows, generate evidence-backed outputs, display progress and results, troubleshoot failures, protect the service, and comply with applicable law. We do not sell personal information.

4. Source handling and retention

Under the current design, uploaded archives are deleted after extraction and isolated workspaces are deleted when processing ends. Generated outputs and minimal run metadata are intended to remain available for up to 24 hours, then be deleted through the retention workflow. Security records may be retained longer where reasonably necessary.

5. Service providers and disclosure

We may use infrastructure, database, storage, monitoring, and optional AI providers only as needed to operate the service. When AI is enabled, only content needed for the configured summarization step is sent. We may disclose information where required by law, to protect users or the service, or during a business reorganization with appropriate safeguards.

6. Security

The service is designed around isolated workspaces, hashed access keys, least-privilege access, transport encryption, durable run state, and deletion workflows. No online service can guarantee absolute security. Do not submit secrets or content you are not authorized to process.

7. Your choices

Do not upload a repository if you do not agree with this processing. You may remove browser-stored recent links through your browser settings. To request access, correction, or deletion for a run, email support@hearrotech.com and include the run identifier where available.

8. Contact and changes

We may update this policy when the service, providers, or applicable requirements change. The latest version and effective date will be published here.