Privacy Policy
Last updated 4 October 2026
DevScan gives developers and their coding agents one identity for signing up to developer services (“vendors”). This policy explains what DevScan collects, what it shares with vendors and what it never reads. It covers this website and the DevScan app, including the devscan command-line tool.
DevScan is an early-stage project. Questions and requests go to contact@devscan.ai.
What we collect
When you sign in with GitHub (and, later, Google), DevScan receives and stores:
- your GitHub account id and username;
- your name and profile picture, if your GitHub profile has them;
- your verified primary email address. DevScan does not let you sign in without one.
DevScan gives you a DevScan developer id and one agent id. It asks GitHub only for read access to your profile and email addresses, and does not keep your GitHub access token after sign-in.
When your agent signs in (for example with devscan login), DevScan stores the login you approved: its label (such as the device name), when you approved it, when it was last used and whether you revoked it. The agent's credential is stored only as a one-way hash.
When your agent connects to a vendor, DevScan records it in your activity log: which vendor, which agent login and when.
Cookies. The app sets a session cookie to keep you signed in, and a short-lived cookie during GitHub sign-in. They are needed for the app to work. DevScan uses no advertising or analytics cookies, and this website sets no cookies.
Logs. Our hosting provider keeps standard request logs (such as IP address, browser and time) to run and secure the service.
What we share with vendors
When you or your agent sign in or sign up to a vendor through DevScan, DevScan gives that vendor what a “Sign in with Google” or “Sign in with GitHub” button would:
- your DevScan developer id;
- your name, your verified email address and, if you have one, your profile picture;
- whether you or your agent is signing in, your agent id, and that you signed in to DevScan with GitHub.
The vendor uses your email address as your account's contact and recovery email, so the account is yours and reachable without DevScan. DevScan shares this only with vendors that you or your agent choose to sign in or sign up to. Once a vendor has it, the vendor's own terms and privacy policy apply to it.
What DevScan never reads
DevScan never sees or stores the API keys that vendors issue to your agent. Your agent shows the vendor a short-lived DevScan pass, and the vendor returns the key directly to your agent. DevScan does not use vendor API keys, and does not act at a vendor on your behalf without authorization from you or an agent you approved.
How we use your information
- to sign you and your agents in, and to show you your agent logins and activity;
- to issue the sign-ins and passes you and your agents ask for;
- to keep the service secure and to fix problems;
- to contact you about the service, if needed.
We do not sell your information or use it for advertising.
Services that process your data
DevScan runs on a small number of providers, which process data on our behalf:
- Vercel, which hosts this website and the app;
- Neon, which hosts the database;
- GitHub, for sign-in.
These providers may process data in the United States and other countries. We may also disclose information when the law requires it.
How long we keep it
We keep your account information, agent logins and activity log for as long as you have a DevScan account. You can revoke an agent login at any time in DevScan. To delete your account and its data, email contact@devscan.ai. Deleting your DevScan account does not delete your accounts at vendors; you manage those with each vendor.
Your choices and rights
You can ask to see, correct, export or delete your information by emailing contact@devscan.ai. Depending on where you live, you may have further rights under data protection law, including the right to complain to your local data protection authority.
Security
Agent credentials are stored only as hashes, and session and sign-in cookies are encrypted. No system is perfectly secure, but we work to protect your information and will tell you about a breach that affects you as the law requires.
Children
DevScan is for developers and is not meant for children under 16.
Changes to this policy
We will update this page when DevScan changes what it collects or shares, and change the date above. For significant changes, we will also let account holders know by email or in the app.