Data Transparency
Complete visibility into how we handle codebase metadata, caching, and AI calculations.
1. What Data Is Collected
We collect structural and operational metrics from public developer sources to generate our auditing scores:
- Public repository metadata (stars, forks, description, tags, languages).
- Pull request velocity timelines (time to review, merge rates, contributor counts).
- npm package registry metadata (package downloads, package dependencies, list of maintainers).
- Public Stack Overflow reputation, active answer tags, and badge categories.
2. What Data Is Never Collected
Strict Non-Collection Safeguards
We never inspect, query, or store:
- Your actual source code files or database credentials.
- Private keys, environment variables, or server configurations.
- Non-public developer email addresses or communication histories.
- Private repository names or commit logs (unless specifically authorized via App installation, and even then, we only analyze structure metadata, never the code content itself).
3. How Metadata Is Used
All codebase and profile metadata is fed into our modular scoring engine (`@ossintel/scoring`) to compute deterministic scores across four main pillars:
- Security Risk: Evaluating dependency vulnerabilities, outdated packages, and secure release procedures.
- Code Quality: Reviewing documentation status, release frequencies, and structured workflows.
- Community Health: Auditing contributor distribution, active response rates, and team alignment.
- Developer Expertise: Calculating knowledge scoring and topics mapping based on verified contributions.
4. AI-Generated Insights
Our insights package (`@ossintel/insights`) uses Large Language Models (LLMs) to synthesize complex metric structures into developer summaries and findings.
These summaries are advisory. We use strictly public metrics to form the context prompt for our AI providers. We enforce confidentiality agreements that prevent our providers from using your codebase metadata to train public models.
5. Caching & Storage
To prevent rate limit exhaustion on third-party APIs, OSSIntel implements a tiered caching strategy:
- Client Cache: Analyzed profiles are cached locally in your browser storage (IndexedDB) for immediate access.
- Server Cache:Query results are cached on our secure servers for up to 24 hours. A manual "re-analyze" request triggers an active bypass of this cache to retrieve fresh data directly from public APIs.
6. User Control & Deletion
We support complete data control. If you want to delete cached calculations:
- You can clear your local browser storage via developer tools.
- You can request deletion of server-cached audit indices by filing a request on our contact page.
- Uninstalling the GitHub App instantly removes all token credentials and prevents future background queries.
7. App Uninstall Process
To completely remove OSSIntel from your account or organization:
- Navigate to your GitHub account or organization settings page.
- Click on Applications and select the Installed GitHub Apps tab.
- Locate OSSIntel and click Configure.
- Scroll down to the danger zone and click Uninstall.
Once clicked, GitHub automatically destroys our installation tokens. All API keys associated with your account are invalidated instantly.