Legal

Privacy policy

Last updated: 24 October 2026

PRISM analyzes the structure, security, dependencies and performance of GitHub repositories. This page explains what it collects, why, who it is shared with and how you can delete it. In short: PRISM never stores your source code, and you can delete everything yourself at any time.

What PRISM collects

• When you sign in with GitHub: your GitHub numeric ID, username, display name and avatar link. PRISM asks GitHub for read-only access to your public profile. If you choose "Allow private repositories", it also asks for GitHub's repo scope, which GitHub only offers as read and write; PRISM only ever reads.
• An access token: kept only in an encrypted, HTTP-only cookie in your browser. It is not stored in PRISM's database.
• Your analyses (signed-in users only): the result of each analysis, meaning the repository name, commit, score, grade, issue titles, file paths, metrics and the AI summary. Repository files are downloaded temporarily to analyze them and are not kept.
• Signed-out visitors: analyses of public repositories are not saved to an account. Hosting providers keep normal technical logs (such as IP address and time of request).

How it is used

To sign you in, to show your repositories and analyses, to keep your history and score trends, and to write plain-language explanations of the findings. PRISM does not sell your data, show ads or build advertising profiles.

Who it is shared with

These services process data on PRISM's behalf:

• GitHub: sign-in and reading repositories you choose to analyze.
• Supabase: the database that holds your profile and saved analyses.
• Vercel: hosting of the website and its server.
• Google (Gemini) or Anthropic (Claude): they receive only analysis facts, such as issue titles, file paths and metrics, to write the summary. They never receive your source code.

Cookies

PRISM uses one sign-in cookie (encrypted, HTTP-only) and a short-lived cookie while you sign in. There are no advertising or tracking cookies. The cookie stays until you sign out, for up to 180 days.

Your choices

• Sign out: ends your session and removes PRISM's access to your GitHub account.
• Delete your data: open Your data while signed in and choose "Delete my account and data". This permanently removes your profile and all saved analyses and revokes PRISM's GitHub access.
• Revoke access yourself: at github.com/settings/applications you can remove PRISM at any time.

Security

Sessions are encrypted with AES-256-GCM, connections use HTTPS, and database tables are locked so that only PRISM's server can read them. No system is perfectly secure, but PRISM keeps the data it holds to a minimum.

Children

PRISM is a developer tool and is not directed at children under 13.

Changes and contact

If this policy changes, the date above changes. Questions or requests: open an issue at github.com/jenishpatel01/prism/issues.