Privacy Policy

Kanon (“we”) provides a hosted service that analyses source code and produces a knowledge base describing a product’s behavior. For customers on Kanon Cloud, we are the data controller for account data and a data processor for the code and repository content you ask us to analyse.

• Account details. Your email address, and — if you sign in with Google — the display name and avatar URL that Google returns. We never receive your Google password.
• Workspace data. Workspace names, membership and roles, invitations, and the repositories you connect.
• Repository content. Source code from the repositories you connect or scan, and the file paths and line numbers that claims cite.
• Product usage. Pages viewed, features used, and errors encountered, via PostHog. Marketing pages additionally use Google Analytics. Both are covered by the cookie banner.
• Billing details. Handled entirely by Stripe. We store a Stripe customer id and your subscription status. We never see or store card numbers.

This is the part that matters most, so it is not buried: to produce a knowledge base, Kanon sends the contents of your source files to OpenAI for analysis. There is no way to use the analysis features without this.

We use the OpenAI API under terms that do not permit your content to be used to train their models. We send only files inside the boundary of the feature being scanned, never your whole repository at once, and we cache extracted results so the same file is not re-sent unnecessarily.

If you would rather no code left your infrastructure at all, Kanon can be self-hosted with your own OpenAI key — see the pricing page.

• Supabase — database hosting, authentication, file storage.
• Vercel — application hosting and delivery.
• OpenAI — code analysis and the knowledge-base chat.
• Stripe — subscription billing and payment processing.
• PostHog — product analytics and session replay.
• Google Analytics — marketing-page analytics only.
• GitHub — only if you connect it, to read the repositories you select.
• Linear — only if you connect it, to create the tickets you approve.

Knowledge-base content and account data are kept for as long as your workspace exists. Delete a repository and its analysis goes with it. Ask us to close your account and we will delete your workspace data within 30 days, except where we are required to retain billing records for tax and accounting purposes.

Downgrading a plan never deletes anything — your knowledge base stays readable; you simply cannot scan beyond the free tier’s limits.

Depending on where you live, you may have the right to access, correct, export or delete your personal data, and to object to certain processing. Email support@gokanon.com and we will respond within 30 days.

You can decline non-essential analytics cookies from the banner shown on your first visit, at any time, without losing any functionality.

Data is encrypted in transit and at rest. Third-party access tokens (GitHub, Linear) are encrypted at rest with AES-256-GCM. API tokens are stored only as hashes — we cannot recover one for you, only issue a new one. Access to a workspace’s data is checked on every request against your membership of that workspace.

If we change this policy materially we will tell account holders by email before it takes effect. The “last updated” date above always reflects the current version.