Privacy policy

This policy applies to cloud-connected CLI features, the hosted dashboard and APIs at https://difflore.dev, cloud sync, connected integrations, billing flows, support, and public product pages. Local-only CLI use remains on your machine unless you log in, sync, upload observations, or connect a cloud integration.

• Account data: email, display name, avatar, OAuth provider IDs, team memberships, roles, and authentication/session records.
• Product data: rules, candidate rules, rule metadata, origins, confidence signals, settings, review history, and related governance decisions.
• Synced team-rules data: selected rules, candidate rules, source metadata, file patterns, evidence excerpts, review summaries, and integration metadata you explicitly send.
• Limited code context: difflore does not upload full repository snapshots as a normal telemetry path. Cloud features process file paths, small evidence excerpts, source metadata, and accepted-outcome context only when you explicitly sync or request an opt-in workflow.
• Billing data: billing customer IDs, subscription IDs, invoice references, plan status, and usage/overage records. The configured billing provider handles payment card numbers and payment-method details.
• Operations data: IP address, user agent, request timestamps, endpoint usage, errors, webhook events, audit logs, and security logs.

We use data to operate, secure, debug, and improve the service; sync rules and settings; provide retrieval and explainability workflows; run candidate governance, optional embeddings, demo previews, and team governance; prevent abuse; provide billing; and respond to support requests.

We do not sell personal data.

The local-first runtime does not require DiffLore-hosted model calls for review mining or edit-time rule injection. Cloud model providers are used only for demo previews, optional embeddings, or explicitly enabled/contracted workflows such as BYOK.

Depending on enabled features, deployment mode, and environment configuration, difflore may use these subprocessors or categories:

• GitHub
• Stripe
• Anthropic
• OpenAI
• Voyage AI
• RackNerd
• Resend
• Cloudflare

Processing regions currently configured for public disclosure: United States.

• Local CLI data remains under your control on your machine.
• Retained while your account or workspace is active, then deleted or anonymized according to the active retention policy.
• Operational logs are currently retained for approximately 30 days unless needed longer for security, abuse prevention, legal, or billing records.
• You may request export or deletion by contacting [email protected].

difflore uses TLS in transit, access controls, audit logs, encrypted secrets where supported, scoped integration tokens, and hosted payment collection through Stripe. No system can guarantee absolute security.

DPA status: Available for Business and Enterprise plans during procurement.

SOC 2 status: Not certified yet; security documentation is available on request.

Depending on your jurisdiction, you may have rights to access, correct, delete, export, or restrict processing of personal data. Contact [email protected] for privacy requests.

Email: [email protected].