Privacy Policy

1. Introduction

Octopus ("we", "our", "us"), operated by SC Technology Limited (registered in England & Wales, company no. 09579805, 3rd Floor, 86-90 Paul Street, London EC2A 4NE), is a source-available, AI-powered code review platform. This Privacy Policy explains how we collect, use, and protect your information when you use our cloud-hosted service. If you self-host Octopus, your own privacy policies apply.

Companion documents: Security Overview (data flow + encryption + access controls), Sub-processors (third-party vendors), DPA (Data Processing Addendum), Data Retention (what we store, for how long).

2. Information We Collect

Account Information

When you sign up, we collect your name, email address, and profile picture through your OAuth provider (GitHub or Google). We do not store passwords.

Repository Data

When you connect a repository, we access its contents through the GitHub, GitLab, Bitbucket, or Forgejo API to create code embeddings and perform reviews. We process pull request diffs, file contents, and repository metadata.

A self-hosted Forgejo repository follows the same review data flow: Octopus reads its contents and sends relevant code to the configured AI services. This applies to both a direct public HTTPS connection and a local connector for private LAN/VPN access. The connector keeps the Forgejo personal access token on your machine, but sends repository contents and review context to Octopus Cloud. Hosting Forgejo yourself does not keep Cloud review processing on your network.

Usage Data

With your permission, we collect usage analytics (page views and feature usage) through Google Analytics. Separate advertising-measurement permission controls the X pixel and linking consented visits to signups and purchases in Unified Ads. Our first-party visitor identifiers are random and are not derived from email addresses or IP addresses. Use Privacy choices to change or withdraw these permissions. Sales and refunds are also recorded as business transactions independently of optional visitor attribution. We track AI token consumption per organization for billing purposes.

3. How We Use Your Information

• To provide AI-powered code reviews on your pull requests
• To create and maintain code embeddings for context-aware reviews
• To authenticate you and manage your organization membership
• To track usage and enforce spend limits
• To improve the product based on aggregated, anonymized usage patterns

4. Code and Data Storage

Octopus stores review and indexing data, including searchable code chunks and embeddings in Qdrant. Retention depends on your deployment and configuration. See the data-retention documentation.

Review results, findings, and AI-generated summaries are stored in our PostgreSQL database and associated with your organization.

5. Third-Party Services

We use the following third-party services to operate Octopus:

• OpenAI for generating code embeddings (text-embedding-3-large)
• Anthropic (Claude) and/or OpenAI for AI-powered code reviews
• GitHub / GitLab / Bitbucket / Forgejo for repository access and webhook events
• Stripe for payment processing (if applicable)
• Google Analytics for consented usage analytics
• X for consented advertising measurement
• Unified Ads for sales reporting and consented visit attribution

Code snippets sent to AI providers are subject to their respective privacy policies. We recommend reviewing their data handling practices.

6. Data Retention

We retain your data for as long as your account is active. When you delete your account or remove a repository, associated data (embeddings, reviews, analytics) is soft-deleted and permanently purged within 30 days.

7. Data Security

We use industry-standard security measures including encrypted connections (TLS), secure authentication (OAuth 2.0), and access controls. API keys and tokens are encrypted at rest.

8. Your Rights

You have the right to:

• Access and export your data
• Request deletion of your account and associated data
• Disconnect repositories at any time
• Opt out of analytics tracking
• Opt out of live team-telemetry visibility (from member settings)

For any privacy-related request (access, export, deletion, or opt-out), email [email protected] from the address on your account. See our Data Retention policy for details.

9. Live Telemetry (Team Monitoring)

For organizations on a paid plan, owners and admins may enable a live team-monitoring dashboard. When enabled, we collect coarse presence (whether a member or agent is currently online) and high-level activity events (e.g. "a review completed", "a repository was indexed") — we do not collect the content of what you view, type, or review.

The lawful basis for this processing is the organization's legitimate interest in operational visibility into its own workspace; it is not based on your consent. Activity events are retained for 30 days (see Data Retention); presence is ephemeral and expires within about 60 seconds of going offline.

Any member can opt out at any time from their member settings; opting out stops presence and activity from being collected for or attributed to them.

10. Self-Hosting

Octopus is source-available. If you self-host Octopus on your own infrastructure, your code never touches our servers. You are responsible for your own data handling and privacy compliance.

11. Changes to This Policy

We may update this policy from time to time. Changes will be posted on this page with an updated revision date. Continued use of the service after changes constitutes acceptance of the updated policy.