What DevMap does with data.

The app

• Scanning and Review happen on your Mac. There is no analytics and no AI service.
• Scan results, the undo history and the action log are held in memory only. What the app does keep on your Mac: your sign-in session and plan receipt (macOS Keychain); the folders you chose, your preferences and integration metadata (small files in ~/Library/Application Support/DevMap); and, if you use Insight, the costs, revenue and scenarios you type in plus daily performance and check-duration history (plain, unencrypted JSON files in that same folder, readable by your user only). None of these files is sent to DevMap.
• The desktop app talks to its backend over a private socket readable only by your user, with no network port.
• DevMap requires a DevMap account. The app contacts the DevMap account service (hosted on Supabase) when you sign in, create an account, verify your email, reset your password, change your name or delete your account, at each start, and about once an hour while it is open, to confirm your account and plan. Those requests carry your email address, your password only when you sign in or reset it, your sign-in tokens and your display name, and never file contents, paths, project names or Git data. After a confirmation the app keeps working offline for up to 7 days.
• The app contacts GitHub or GitLab only if you connect that optional integration (experimental, tested only against simulated services).
• If you connect one, the access token is stored in the macOS Keychain, and a small metadata file (account name, permissions, timestamps) is written to ~/Library/Application Support/DevMap. Disconnecting deletes both.
• The app has no analytics or telemetry and does not check for updates. Your account (email, display name, plan) is kept by the account service until you delete it; deleting removes it, and the hosting provider’s own backups and logs are outside DevMap’s control.

This website

• No analytics, tracking, cookies, third-party fonts or external scripts. Every file is served from the site itself.
• The Log in, Sign up and Reset password pages contain forms that are not connected to any sign-in service yet. Nothing you type there is sent or stored, and the pages make no network request. If sign-in is ever switched on, this summary will change first.
• There are no payments, and the site sets no cookies.

Not yet covered

A formal privacy policy, a data-controller contact and retention terms have not been written. Until they exist, treat this page as a description, not a commitment.