Privacy policy

StackPrism (“we”) runs stackprism.ai, a tool that designs software stacks from a description, maps GitHub repositories into diagrams and checks the technologies in them for known problems. For anything privacy-related, email hello@stackprism.ai.

• Account details. When you sign in with Google (through Supabase Auth) we receive your email address, name and profile picture, and a user id. If you try StackPrism before signing up, we create an anonymous guest session with no personal details attached.
• What you create. Project names and descriptions, the text or files you give us to design or map a stack, and the diagrams we generate. These are stored when you save a project.
• Usage records. For each AI request we log which feature you used, when, the number of tokens it used and its cost to us. This enforces the free allowance and the Pro fair-use limit.
• Billing details. If you subscribe, Stripe handles your card. We never see or store card numbers. We keep your Stripe customer id, subscription status and billing dates.
• GitHub connection. If you connect GitHub, we store an access token (encrypted), your GitHub username, and which repositories and branches you linked.
• Product analytics. Pages you visit, clicks and product events (for example “diagram generated”), your browser and device type, the referring site and any campaign (utm) tags on the link you arrived from. See section 6.

We don't sell your data, and we don't use it for advertising profiles.

To design or change a stack we send the relevant input to an AI model provider. Today that's OpenAI. What we send depends on the feature:

• Stack design: the idea or description you typed, and any technology choices you picked.
• Pasted configs and uploads: the text of what you pasted or uploaded.
• Repo maps: selected files from the repository (manifests, config files, API routes and function entry points), read at scan time.
• Prism Agent: your message, recent messages in that chat, and a summary of the diagram and its health.

OpenAI processes this to return a result. Under its API terms, OpenAI doesn't use API data to train its models. We may switch or add model providers (for example Google Gemini); we'll update this page when we do.

We may also send the same prompts and responses, with your user id or email, to Langfuse, an LLM monitoring service, so we can debug bad answers and track quality. This is only active when we switch tracing on.

Connecting GitHub is optional. GitHub's OAuth only offers private-repository access through its repo scope, which technically allows writing too. StackPrism only reads. We never push commits, open pull requests or change settings.

• Your access token is encrypted at rest (AES-256-GCM) and only decrypted on our servers to read files.
• We don't store your source code. Files are read during a scan, sent to the AI model provider as described above, and discarded. We store the resulting diagram and the commit it was built from.
• For linked repos, daily jobs re-read dependency manifests (package.json, requirements.txt, go.mod and similar) to check for new vulnerabilities and, if auto-sync is on, re-map the repo when it has new commits. The same rules apply: files are read, processed and discarded.
• You can disconnect GitHub at any time, which deletes the stored token. You can also revoke access from your GitHub settings.

Stack Pulse checks your technologies against public sources: OSV.dev (vulnerabilities), npm and PyPI (latest versions), endoflife.date (support dates) and vendors' public status pages (outages). We only send package or technology names and version numbers. Nothing identifying you or your project is sent.

We use PostHog (EU cloud) to understand how people use StackPrism. It records page views, when you leave a page, clicks and the product events we define. It doesn't record what you type into text boxes. If we turn on session replay to see where people get stuck, text you type is masked. When you sign in we link your analytics to your user id, plan and sign-up date, not your email.

We store a few things in your browser:

• Supabase sign-in cookies, so you stay signed in.
• A PostHog identifier (cookie and local storage), so visits can be counted.
• Where you first came from (campaign tags, referring site, landing page) for 90 days. We attach this to your subscription in Stripe if you upgrade, so we know which channels bring paying customers.
• Your work in progress: unsaved diagrams, Prism Agent chat history, your progress through the next-steps strip, panel sizes and a hint of your plan. These stay on your device and aren't sent to us unless you save or send them.

We don't use advertising cookies. Blocking analytics in your browser won't break the app.

If you create a share link for a project, anyone with the link can see that project's name, description and latest diagram. Share pages aren't indexed by search engines. You can turn a link off at any time.

We rely on these services to run StackPrism. Each only gets what it needs for its job:

• Supabase: sign-in, and the database for accounts, projects, diagrams and usage records.
• Vercel: hosting. Every request passes through Vercel's servers.
• OpenAI: AI processing, described in section 3.
• Langfuse: AI request monitoring, when enabled.
• Stripe: payments and subscription management.
• PostHog: product analytics.
• Google: sign-in.
• GitHub: repository access, if you connect it.

Some of these providers are in the United States, so your data may be processed outside your country.

• Account, projects and diagrams: until you delete them or ask us to delete your account.
• Usage records: for as long as your account exists, so allowances and fair-use limits work.
• Billing records: Stripe keeps invoices and payment records as tax and accounting law requires, even after you cancel.
• Guest sessions that are never turned into an account hold no personal details.

You can ask for a copy of your data, a correction, or for your account and everything in it to be deleted. Email hello@stackprism.ai from the address you sign in with and we'll handle it within 30 days. You can delete individual projects yourself at any time, disconnect GitHub from the app, and cancel your subscription from the billing page.

If you're in the UK or EU you also have the right to object to processing and to complain to your data protection authority. We'd appreciate the chance to fix things first.

When we change how we handle data we'll update this page and the date at the top. For significant changes we'll tell signed-in users in the app. The terms of service cover the rest of the rules for using StackPrism.