This Privacy Policy explains what information Verglas LLC (“Verglas”, “we”, “us”) collects when you visit perchscan.com or use Perch Cloud (the “Service”), how we use it, and the choices you have.

The open-source Perch CLI runs on your computer. When it is not connected to Perch Cloud, it sends us nothing, and your code goes only to the model provider you configure.

Information we collect

Account information. When you sign up or sign in, with GitHub or an emailed code, we receive your email address, your name if available, and an account identifier from our identity provider. When you connect GitHub, we receive your GitHub account name and the repositories you choose to share with the Perch GitHub App.

Workspace information. Workspace names, members and their roles, invitations, repository names and settings, CI configuration, and hashed CI credentials.

Code submitted for analysis. When a scan uses Perch Cloud, the relevant source code and rule questions are sent through the Service to our model provider to be analyzed. We do not store your source code after the analysis. We keep a one-way hash of each analysis request together with its answer, so that unchanged code can be answered from the cache.

Scan results. File paths, function and method names, line numbers, findings, scan status, and timing, shown in your dashboard and posted to your pull requests if you enable that.

Usage and billing. Usage charged, cached results served, model token counts, requests, and the member or CI credential they are attributed to. Monthly usage totals reported to Stripe for invoicing, any monthly cap you set, whether billing is set up and payments are current, and your card’s brand and last four digits. Full payment card details are collected and stored by Stripe, not by us.

Forms on perchscan.com. If you ask to be notified or contact us, we collect the email address and any name, company, and message you provide, along with your approximate country.

Product and site analytics. We use PostHog to measure visits, campaign sources, signups, scans, product usage, and payments. PostHog uses a browser identifier stored in cookies and local storage to recognize returning visitors. After sign-in, events are associated with your account identifier and workspace. Events include page paths, browser and device information, usage totals, and billing amounts; they do not include submitted code, scan findings, credentials, or form contents. Automatic interaction capture is disabled.

Optional session replay. After you accept browser analytics, PostHog can record page layouts, navigation, pointer movements, clicks, and scrolling on perchscan.com and the dashboard. Text and form values are masked before transmission. Images, embedded frames, canvas content, and hidden or file inputs are excluded. Replay omits private link and data attributes, URL queries and fragments, console logs, and network request and response contents. You can stop future recording through Analytics preferences. Browser Global Privacy Control and Do Not Track settings keep recording disabled.

Search traffic measurement. On perchscan.com, optional Google Analytics measures visits, traffic sources, command-copy clicks, and clicks to the dashboard, docs, GitHub, and npm. It uses analytics cookies after you allow it. We remove URL fragments, query parameters other than permitted campaign tags, and referring paths. We do not send account identifiers, workspace details, form contents, or source code to Google Analytics. Advertising storage, personalization, and Google signals are disabled. A command-copy or dashboard click measures intent, not a completed installation or signup. OpenSEO displays aggregate Google Analytics reports.

Technical data. Our hosting provider processes IP addresses, browser user agents, and request logs to deliver the Service, prevent abuse, and limit sign-in attempts.

Connected AI clients

When you connect Perch to ChatGPT or another MCP client, WorkOS authenticates your account and you choose a workspace. The connection can read your account name and email, workspace and repository information, scan settings and results, pull request review comments and replies, and GitHub Actions jobs, test results, and logs. Workspace admins can also change pull request scan settings through the connection. Perch checks workspace membership and permissions for each operation.

Tool results are shared with the client you connect. For ChatGPT, OpenAI receives those results and handles them under the terms and privacy settings of your OpenAI account. Repository information, review comments, and logs can contain private code or other sensitive information. Connect only workspaces whose information you are authorized to share. Removing the connection in your client stops its future use; information already shared is subject to that client’s retention and deletion practices.

Cookies

Perch Cloud uses cookies needed to sign you in and keep you signed in securely. These cover your session and short-lived sign-in state.

Optional browser analytics loads only after you allow it. Choose Accept or Decline in the cookie panel, and use Analytics preferences to change your choice. Browser Global Privacy Control and Do Not Track preferences keep browser analytics disabled. Your choice is stored locally for up to six months; analytics cookies expire after 30 days. Declining analytics does not affect access to the Service. Server-side signup, scan, usage, and invoice events are still recorded to measure delivery and billing; these events do not use browser analytics cookies.

How we use information

We use information to provide and secure the Service; to authenticate you; to run analyses and show results; to meter usage and bill you; to send service emails such as sign-in codes, receipts, and low-balance notices; to respond to support requests; to understand how the site and Service are used in aggregate; and to comply with law. We do not sell personal information, and we do not use your code to train machine learning models.

Service providers

We share information with providers that process it on our behalf to run the Service:

We may also disclose information if required by law, to protect the rights and safety of users or others, or as part of a merger, acquisition, or sale of assets.

Retention and deletion

We keep account and workspace information while your account is active. Cached analysis answers are kept until storage limits remove the least recently used ones or your workspace is deleted. A scan’s findings are deleted 30 days after the scan; its summary, with the number of issues it found, stays. When you delete your account from Settings, we delete the workspaces you own, including their scans, findings, cached answers, repositories, and credentials, and remove you from other workspaces. We keep billing records for as long as tax and accounting law requires.

Security

We use encryption in transit, hashed credentials, scoped access tokens, and access controls to protect information. No method of transmission or storage is completely secure.

Your choices and rights

You can view and update your profile in Settings, disconnect GitHub, and delete your account at any time. Depending on where you live, you may have rights to access, correct, delete, or export your personal information, or to object to certain processing. To make a request, email support@perchscan.com. We will not discriminate against you for exercising these rights.

International transfers

Verglas is based in the United States, and our service providers may process information in the United States and other countries.

Children

The Service is not directed to children under 16, and we do not knowingly collect their personal information.

Changes

We may update this Privacy Policy. If we make material changes, we will update the effective date and ask you to agree to the new version when you next sign in, or notify you by email.

Contact

Verglas LLC, Oregon, United States. Email support@perchscan.com.