KirinBoard privacy policy

Kirin Solutions LLC ("Kirin Solutions", "we", "us") operates KirinBoard, a service that helps software teams monitor development activity, builds, tests, projects and AI agents connected to GitHub. This policy explains what personal information we handle, why we handle it, who receives it, how long we keep it and your rights.

This policy covers visitors, users, workspace administrators and people whose activity appears in connected repositories. It applies to the service we host; organizations operating their own deployments are generally responsible for their deployments' data practices.

1. Information we collect

Depending on how you use KirinBoard, we process:

• Account and contact information: GitHub username and numeric account identifier, sign-in dates, email address where available or provided, and communications with us.
• Workspace information: connected GitHub organizations and repositories, member names, roles and permissions, workspace settings and administrative actions.
• Development information: repository metadata, issues, pull requests, commit messages, project information, build and test results, workflow status and AI agent activity. This may include personal information and confidential text entered by contributors.
• Integration information: authorization, permissions and activity records associated with API tokens and connected AI assistants.
• Connected machines (optional): if you connect a computer to KirinBoard with our session sensor, the name you give the machine, who connected it and when, the sensor's version, and, for each terminal session it reports, the session's name, whether it is still open, whether an AI agent is running in it, when it was last active, and the branch and issue the agent is working on. The sensor reports nothing else, and you or a workspace administrator can disconnect the machine at any time.
• Technical information: IP addresses, browser and device information, essential cookies, access and security records, and diagnostic information.
• Subscription information: plan, seat and billing records where relevant. Payment card data is handled by our payment processor; we do not store full card numbers.

We obtain this information from you, GitHub, your organization, your browser or device and integrations you authorize. We do not buy personal information or use advertising trackers.

GitHub sign-in: GitHub handles your password and two-factor authentication. We do not store the GitHub user access token issued for sign-in; it is used during authentication and then discarded.

2. Why we use information

We process information to provide the Service, authenticate and manage accounts, display authorized development information, operate integrations, manage subscriptions, maintain security, troubleshoot and improve reliability, respond to requests, send service notices and meet legal obligations.

Where required by applicable law, our bases for processing include performance of a contract, legitimate interests in operating and protecting the Service, legal obligations and consent where necessary. We generally act as controller for our own accounts, communications and security records, and as processor or service provider for repository information handled on a customer's behalf, subject to applicable law and agreements. Appropriate data processing agreements are available where legally required.

Email: We may send security, account, billing and policy notices, and replies to your inquiries. We may also send KirinBoard news and offers where permitted by law, obtaining consent where required. Marketing emails provide an unsubscribe method; unsubscribing does not stop necessary service notices. We do not use tracking pixels or tracked links in our emails.

Aggregated statistics

We may combine development and usage information across workspaces into aggregated statistics about builds, tests, development activity and AI agent use. We may analyze, publish, license or sell these statistics, subject to all of the following protections:

• They do not identify any individual, organization or repository, or include source code, confidential repository content, file names, issue or pull request text.
• Each figure we publish or share is drawn from at least 10 different workspaces. We also apply additional safeguards where a figure could otherwise reveal information about a particular workspace.
• We do not try to re-identify anyone behind the statistics, and require recipients licensing the statistics not to do so.

We use personal information to create statistics where permitted on the basis of our legitimate interests, subject to applicable privacy rights. You may object to this processing at privacy@kirinboard.ai. Where an objection applies, we will exclude your personal information from statistics created afterward, unless a lawful overriding ground applies. Previously created, properly anonymized statistics cannot necessarily be traced to an individual and may be retained.

We do not sell identifiable personal information or confidential customer content.

3. Source code, repository content and integrations

Repository source files remain in GitHub. The main KirinBoard GitHub App does not request GitHub's Contents permission. We do not clone or store customers' repository source files.

To display development activity, KirinBoard reads selected GitHub metadata and information such as issue and pull request text, commit messages, checks and workflow results. This information can contain code snippets or confidential details entered by contributors. KirinBoard does not download or clone your repositories, and never modifies your code. We do not intentionally save this free-text content or changed lines. Free text is held only briefly while we provide the Service, including to an AI assistant you connect, and is then discarded; it never enters our backups. We do retain limited workspace and repository identifiers, settings, access records and summarized operational metrics.

When the GitHub App is uninstalled, its authorization to access the connected repositories is revoked. We delete the associated workspace information following the uninstall notification, subject to limited backup retention and legally permitted exceptions. Users may also delete their account through Your account or ask us to delete information using the contact details below.

Runner Control: An optional, separately installed KirinBoard Runner Control GitHub App requires organization-level Self-hosted runners: Read and write permission. GitHub grants this permission for operations including runner groups, runner registration and removal tokens, and runner deletion. KirinBoard currently uses the permission only for authorized workspace administrators to change runner labels for pause/resume functionality. Installation is optional and requires approval through GitHub. This App does not request repository Contents permission.

Runner Visibility: An optional, separately installed KirinBoard Runner Visibility GitHub App requests repository-level Administration: Read permission, on the repositories the installing user selects. The permission is read-only. KirinBoard uses it only to read the list of self-hosted runners registered on those repositories (each runner's name, labels and status: online, offline or busy), to show that list in the dashboard to the members of the workspace. GitHub's Administration: Read permission can also read other repository settings, such as branch protection rules, deploy keys and traffic statistics; KirinBoard does not read them. This App does not request repository Contents permission, so it cannot read repository source files, and it cannot change anything. Installation is optional, and a repository can be removed from it, or the App uninstalled, at any time in the account's GitHub settings.

AI assistants: KirinBoard does not send repository content to an AI model on its own or use it to train AI models. If you connect an external AI assistant, selected dashboard information is shared at your direction. The assistant provider's own terms and privacy practices govern the information it receives, which we cannot delete on its behalf.

We treat non-public customer information as confidential, as described further in our Terms of Service and applicable customer agreements.

4. Sharing information

We may share information with service providers performing hosting, network security, communications, payment processing and related operational services; with your organization's authorized workspace users; with integrations you authorize; when legally required or necessary to address misuse or protect rights; and in connection with a business transfer subject to appropriate protections.

GitHub processes information under its own terms. Providers of AI assistants connected by customers are independent third parties for information they receive from those integrations.

We do not sell or share personal information for cross-context behavioral advertising. The separate use of anonymized aggregated statistics is described in Section 2.

5. Retention, deletion and security

We retain information for periods appropriate to its purpose, subject to legal and security exceptions:

When an account or workspace is deleted, we remove associated information in accordance with our deletion procedures. Copies may remain temporarily in backups and limited records may be retained for legal, security or compliance purposes. Properly anonymized statistics may be retained.

We use reasonable technical and organizational safeguards designed to protect personal information. No internet service can guarantee absolute security. We provide security-incident notices where required by law.

KirinBoard uses cookies needed for authentication, security and essential operation, along with browser-local display preferences. We do not use advertising or third-party analytics cookies.

6. International processing

KirinBoard is operated from the United States. Information may be processed in the United States and in locations where authorized providers operate. Where legally required, we use applicable safeguards for international data transfers, and you may request further information from us.

7. Your privacy rights

Depending on where you live and applicable law, you may have rights to access, receive, correct, delete, restrict or object to processing of your personal information, withdraw consent where relevant, appeal certain decisions and complain to a data protection authority. You may contact privacy@kirinboard.ai to exercise these rights. You do not need a KirinBoard account to submit a privacy request. We may verify your identity and will respond within applicable legal deadlines. Lawful exceptions may apply.

If your information appears in a GitHub repository connected by an organization, the organization may be responsible for the original content; we will assist with relevant requests as required.

California notice: In the preceding 12 months, the categories of personal information we have collected include identifiers (such as GitHub usernames, numeric IDs, email and IP addresses), internet or network activity (such as usage and security logs), professional or workspace activity, and information submitted through communications or connected repositories. Sources include individuals, their devices and browsers, GitHub and the organizations that connect workspaces. We use and disclose these categories for the purposes and to the recipients described in Sections 2 and 4. We do not sell or share personal information for cross-context behavioral advertising and do not discriminate against people for exercising applicable privacy rights. California residents may have further rights where California privacy law applies.

Residents of the UK, European Economic Area and Switzerland may have additional rights under applicable privacy law, including rights to object to certain processing and lodge a complaint with a supervisory authority.

KirinBoard is intended for professional users aged 18 or older and is not directed to children.

8. Changes and contact

We may update this Policy and will show the applicable version and effective date. Where a change affects how we collect or use information, we will provide notice and request renewed acceptance as required by our Service procedures or applicable law.

Privacy questions and requests: privacy@kirinboard.ai
Account and workspace support: support@kirinboard.ai
Security reports: security@kirinboard.ai

Kirin Solutions LLC, California, United States.

See also our Terms of Service.