What we collect
Last updated: 29 October 2026
What Stackat keeps about your organisation, item by item, how long, and what it never keeps. Short-lived server logs (with names already replaced by pseudonyms) and survey answers are covered in the privacy policy.
When you apply or ask to upgrade
| What | Why | Kept for |
|---|---|---|
| Name, work email, company, role, where your code is hosted, number of repositories, what hurts (optional) | To decide on your application and answer it | The email is erased as soon as we answer. The rest: 12 months. |
| An upgrade request from your dashboard: name, work email, company, a note (optional), for your organisation | To agree a price and invoice your organisation | The email is erased as soon as we answer. The rest: 12 months. |
| A salted hash of your network address (never the address) | At most 3 applications an hour per network | With the application |
We are notified in Slack without your email address.
When your organisation uses Stackat
| What | Exactly | Why | Kept for |
|---|---|---|---|
| Your account | The installation, a pseudonym for your organisation (a keyed hash of GitHub's numeric id), your plan, the date you joined and, on a trial, the day it ends | To know whose repositories to scan, and on which terms | Until your organisation's data is deleted (below) |
| Repositories | A pseudonym for each repository the app may see, and its default branch | To scan the right ones | Until your organisation's data is deleted (below) |
| Scan results | Tool names, versions, and the file and line where each is pinned; the names of configuration keys you set (never their values, except true/false switches) | To match release notes against what you actually use | Until the next scan replaces them |
| Issues and pull requests Stackat opened | Their numbers, the text Stackat wrote, and whether they are open, closed or merged | So an issue is written once and closed when you are up to date; to count upgrades delivered | Until your organisation's data is deleted (below) |
| Your feedback | 👍 / 👎 counts on Stackat's issues, and replies addressed to Stackat (/stackpaw …), with a pseudonym for the author |
To fix what we got wrong | Until your organisation's data is deleted (below) |
| Dashboard sign-in | Nothing stored: after you sign in with GitHub, your organisations and repository names are held in memory, with one session cookie on app.stackat.dev that only keeps you signed in | To show you your own organisation | 8 hours, or until you sign out |
| Slack notifications (if you connect them) | Your channel's webhook address and the channel and workspace names, encrypted; which issues were announced and the week of the last digest | To tell your channel about urgent fixes and send the weekly digest | Until you disconnect, or your organisation's data is deleted |
| Slack buttons (if people link their account) | Each linked person's Slack user and workspace ids and GitHub account, encrypted, with the date they linked | To check that a button press comes from someone allowed to act on the issue | Until they unlink, Slack is disconnected, or your organisation's data is deleted |
| Jira (if you set it up) | Nothing: the settings stay in your repository, and the ticket is created in your Jira by you | – | – |
| Findings held back for review | A finding that failed our quality check, with the lines it points to either sealed with a key held offline or dropped | So we can see why it failed before anything is published | Until it is reviewed, or your organisation's data is deleted |
| What the release-notes service learns | Which tool versions are in use and how many organisations run them, never which ones | To digest the releases people need first | Counts only |
What we never keep
- Your code. Stackat only touches what you define: the infrastructure files of each repository (YAML, Terraform, HCL) at its latest commit, narrowed further by a
scan:section in.stackat.yml. They are held in memory while they are scanned and gone when the scan finishes; application code stays on GitHub. (Very large repositories, tens of thousands of files, are fetched whole for the scan and deleted right after it.) - Readable names. Organisation, repository and user names are replaced by pseudonyms everywhere they are stored, logged or shown; a real name is kept only sealed with a key held offline, to answer you when you write to us.
- Secrets and values. Kubernetes Secrets are skipped, and configuration values are not kept.
- Anything sent to AI. The AI model reads public release notes only; none of your data reaches it.
- Tracking. This website sets no cookies and runs no third-party trackers or advertising.
When you leave
Remove the GitHub App and we stop at once: nothing is scanned or written any more. Everything about your organisation is deleted 90 days later, automatically, or at once when you ask: write to info@progrex.dev (a copy first, if you want one) and we confirm when it is done. Backup copies age out within 12 months. Issues and pull requests Stackat opened in your repositories are yours to keep or delete.
The legal side is in our privacy policy and data processing terms.