> For the complete documentation index, see [llms.txt](https://pharaoh.so/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://pharaoh.so/docs/use-pharaoh/terms-and-privacy.md).
# Terms and privacy
Pharaoh's terms of service and privacy policy: what we collect, how long repository metadata is kept, billing terms and how to request deletion.
Last updated: November 3, 2026
[Terms of Service](#terms) · [Privacy Policy](#privacy)
## Terms of Service
### 1. What Pharaoh Does
Pharaoh (“we”, “us”, “the Service”) provides codebase intelligence via MCP (Model Context Protocol) tools. We parse your repositories into knowledge graphs that coding agents can query. A graph holds structure (names, file paths, dependencies, complexity scores) and excerpts such as function signatures and doc comments; section 9 describes what it holds. **We never store source code.**
### 2. Account & Access
You authenticate via GitHub OAuth. By using Pharaoh, you confirm you have authority to grant read access to the repositories you connect. We verify organization membership on every token refresh. Access is scoped to your GitHub organization or personal account.
### 3. Billing
Pro replaces the Personal and Team plans when it launches; until then those plans apply as before. From launch: every account you install starts a trial. After it, Pro is billed monthly via Stripe to the person who pays: one subscription covers every account you own, plus a seat for each other person Pharaoh answered in the last 30 days in those accounts. Seats are counted daily and billed from the next invoice, never mid-cycle. You see the exact charge before you confirm it; nobody is charged without that. Current pricing is listed on our [pricing page](https://pharaoh.so/#pricing). Personal and Team subscriptions started before then keep their plan and price. PR Guard is included in every paid plan with no per-repo add-on charges. Prices may change with 30 days notice. You can cancel anytime through the [billing portal](https://pharaoh.so/manage)—access continues through the end of your current billing period. No refunds for partial months.
### 4. What We Store
We store: repository metadata and excerpts, your GitHub identity, records of how you use the Service (all listed in section 9), and billing records (Stripe handles payment; we never see card numbers). We do **not** store source code, file contents, function bodies, or environment variable values (see section 10).
### 5. Data Isolation
Your data is isolated through application-level controls: every graph query is scoped to your repositories, and repo ownership is verified against your account before each request. Your architectural data is never visible to other customers.
### 6. Acceptable Use
Don’t use Pharaoh to: reverse-engineer others’ codebases without authorization, circumvent access controls, or resell access. We may suspend accounts that violate these terms.
### 7. Availability & Liability
We aim for high availability but don’t guarantee uptime. Pharaoh is provided “as is.” Our total liability is limited to the amount you’ve paid us in the last 12 months. We are not liable for decisions made by AI tools based on Pharaoh’s data.
### 8. Changes to Terms
We may update these terms. Material changes will be communicated via the email associated with your GitHub account at least 14 days in advance. Continued use after changes take effect constitutes acceptance.
## Privacy Policy
Pharaoh is operated by 2407066 Alberta Inc. This policy explains what data we collect, why, and how we protect it.
### 9. Data We Collect
| Category | What | Why |
| -------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| GitHub identity | GitHub user ID, username, display name and avatar URL; your email address (see below); organization membership and repository access; installation ID | Authentication, authorization, tenant isolation |
| Repository metadata | Repository names, the ID of the latest mapped commit and the repository’s `.pharaoh.yml` settings, if it has that file; function, class and constant names; file paths, module boundaries and package names; which files import each other, which functions call each other and which classes extend which; complexity scores, line counts and line ranges, whether a function is exported or async, and whether a file is a test; function signatures as written, including parameters, types, default values and return types, with no length limit, so a default value can include code; up to 200 characters of each doc comment or Python docstring; one-way hashes of function bodies; values of top-level constants (TypeScript and JavaScript strings and numbers of up to 128 characters, skipping constants named KEY, SECRET, TOKEN, PASSWORD or CREDENTIAL, or ending in `_KEY`, `_SECRET`, `_TOKEN`, `_PASSWORD` or `_CREDENTIAL`, in any case) and their type annotations; HTTP routes and methods, cron schedules, database table names, event names and environment variable names; each file’s last-modified date and how often it changed in the last 90 days; and import paths a map couldn’t resolve | Knowledge graph construction (our core service) |
| Billing | Stripe customer ID, subscription status, connected-repository count and one live repository name on the customer record; for Pro (from launch), the GitHub user ID of the person whose subscription covers each account, with that person’s Stripe customer and subscription IDs and their trial and payment state; and a record of the first paid Personal, Team or Pro subscription for each billed GitHub account or payer, including invoice reference, amount, currency and an opaque transaction ID | Subscription management, account support and preventing duplicate purchase measurement |
| Seat usage | For each account, the GitHub user ID of each person Pharaoh answered a question for, and when it last did | Counting the seats on the subscription that covers the account |
| Usage logs | For each MCP tool call: the tool, the arguments your agent sent (such as repository names, search terms and function names), when it ran and how long it took, the response size, any error, your GitHub user ID and username, and the session ID. A text argument longer than 500 characters is cut to 500 (text inside a list argument is stored in full), and arguments named token, password, secret, key, authorization or credential are replaced with `[REDACTED]`. For each PR Guard check: the pull request number, the commit checked and the result. For each scored pull request: its number, the commit scored, the author’s GitHub user ID and username, the score, and how many exported functions the pull request added and changed. Milestones such as your first sign-in, first map and first tool call | Recording rate-limit refusals, debugging, audit trail, onboarding, scheduling map refreshes, product analytics |
| Onboarding | Your answer to “What made you try Pharaoh today?”: the option you chose and, if you choose “Something else”, up to 300 characters you type (a few words; no code or secrets). Skipping stores nothing. Also which setup actions you dismissed, one-way hashes of the tool calls behind the prompts we offered you, when your AI client first got an answer and in which session, when you finished setup, and when we first saw a Pharaoh call that no offered prompt explains | Choosing your first prompt and the dashboard’s lead, ticking setup actions, and learning why people try Pharaoh. The check-in email may quote the option you chose, never your typed text, which also never goes into logs, analytics or site-visit records |
| Connection records | For each MCP session, the name and version your agent reports (for example `claude-code` and its version number) and the connection type; through the npx proxy, also the agent running it and whether the Pharaoh plugin is enabled. For device sign-ins, the IP address and user agent of the `/device` request and of one-click approvals on `/activate` | Support, client compatibility, abuse detection |
| Server logs | Application logs of sign-ins, errors and refused requests, with GitHub usernames and IDs, repository names and, for some requests, an IP address or user agent | Debugging and security |
| Alert records | Internal alerts about mapping, account and billing problems, which can name an account, a repository or a GitHub username | Operating and monitoring the service |
| Site visits | A random visitor ID kept in a cookie; the pages and page sections you view; how far you scroll (25, 50, 75 and 90%); how long a page stays in the foreground (10, 30 and 60 seconds); which Install or setup button you click and the plan it’s for; which copy button you use, never what you copy; whether the FAQ comes into view, which entries you open and which links in them you click; whether you change the pricing calculator or open its assumptions, never the values you enter; the site or page that sent you; and any campaign tags in the link; when you follow our Install link, a server record of that navigation and its public source page, and your arrival on setup | To learn which channels bring people who go on to use Pharaoh and how they use our pages |
| Optional advertising measurement | If you allow it, Google Ads processes visits to and interactions with our public marketing pages, such as scrolling and link clicks, ad-click identifiers and cookie identifiers, along with browser and network information such as your IP address. For a completed first Personal or Team purchase, we also send an opaque transaction ID, the paid amount and its currency. | To measure our Google Ads campaigns and paid conversions; advertising personalization is disabled |
When you sign in with GitHub we store your primary verified GitHub email. We use it for setup emails, each with a one-click unsubscribe, and as the email on your account’s Stripe customer record (section 12). We send at most two setup emails while you haven't connected an AI client: one when every repository in your accounts has been mapped, and one asking what made you try Pharaoh and what got in the way. That second email is either a reminder three days after you install or, if it reaches you first, a plain-text check-in sent four to fourteen days after we first see your GitHub account. Nobody gets both. Once you connect, the check-in is the only setup email still to come, unless you've had the reminder. We don't send it after your account uninstalls the GitHub App. From Pro's launch, the map-ready email also goes to you if you have already connected, since the setup screen promises it; we skip it when mapping finished within 15 minutes of install. While your account is on a trial, we also email you when the trial starts, the day before it ends if no payment method is on file, and when it ends. You never get more than one setup or trial email in 24 hours. We never collect your teammates' email addresses and never use the email addresses in commits. If you reply, your reply reaches us like any other email you send us. Our email provider, Resend, tells us whether each email was delivered, bounced, opened or clicked; for a click, its report includes the IP address and browser that clicked. We keep those reports with your unsubscribe choice.
**Enterprise consultation requests.** On our enterprise page, we record page views, consultation-button clicks and sanitized campaign/referrer labels separately from our product-install funnel. When you open the form, we create an anonymous draft and save your optional qualification answers and progress as you go, including incomplete responses. We use these answers to improve the form and understand interest in the service. Contact fields stay in your browser until you press **Book a call**. On submission, we save your name, email address, company website, optional phone number, optional discussion notes and qualification answers so Dan can follow up. We do not require a work-email domain. Please do not put source code, credentials or other secrets in the discussion field.
Qualification answers and contact details are separate from finite interaction events, which record steps viewed, answers changed or skipped, backtracking, closing, submission outcomes and calendar handoffs or link clicks. Events contain no contact details, phone number or discussion text. A handoff or calendar click is not a confirmed booking. After submission we may send one acknowledgement using Resend; it receives your email address and the message, without your phone number. This consultation acknowledgement is separate from GitHub setup emails. When you press **Book a call**, we save your response before opening the configured booking provider in the same tab. We do not put your answers or contact details in the booking link. If no booking provider is configured, we show a follow-up confirmation instead. We also record founder-entered commercial follow-up stages and their supporting reference for the submitted company.
### 10. Data We Do NOT Collect
**Source code.** To map a repository or check a pull request, we clone it into a temporary directory on our servers and delete that directory when the job ends, including when the job fails. We don’t store source code, file contents, function bodies, comments other than the first 200 characters of each doc comment, environment variable values, commit messages, authors or diffs. The [open-source parser](https://github.com/Pharaoh-so/pharaoh-parser) shows what is extracted from function, class and constant definitions; section 9 lists the rest. **Credit card numbers.** Payment is handled entirely by [Stripe](https://stripe.com/privacy). We never see or store card details.
### 11. How Data Is Stored
Repository metadata is stored in Neo4j (graph database) with query-level isolation per customer. Operational data (account records, repository names and mapping status, sign-in sessions, usage logs) is stored in PostgreSQL, along with mapping-quality records, which can include import paths a map couldn’t resolve. Both are hosted on infrastructure with encryption at rest and in transit. On top of that, we encrypt a few fields ourselves with AES-256-GCM: GitHub tokens before storage, and function signatures, doc comments and constant values with a key derived for your account before they enter the graph. The rest of the repository metadata in section 9 (names, file paths, modules, dependencies, HTTP routes, complexity scores) has no encryption beyond the hosting providers’. Pharaoh’s own access and refresh tokens are stored only as SHA-256 hashes.
### 12. Data Sharing
We do not sell your data. We share data only with:
* **GitHub** — sign-in, repository access, looking up your public profile name and avatar, and the check results PR Guard and setup post to your repositories
* **Stripe** — billing and payment processing. When you install the GitHub App, we create a Stripe customer for the account, whether or not it subscribes, with the account name, the Pharaoh account ID and whether it is a personal or organization account. If that fails, we create it later, when someone signs in or checks out. A primary verified GitHub email can fill the account’s missing contact when a confirmed admin signs in from an AI client or the billing page, or when the recorded installer or personal owner signs in on the setup page. To fill a missing Stripe email, we use an address with authenticated verification recorded for the personal owner, installer or a recorded admin, preferring the existing account contact when it matches an eligible address. Existing account contacts and emails already set in Stripe are preserved. Periodic synchronization retries missing updates; historical addresses without verification evidence are not used. Customer metadata also includes the number of connected GitHub repositories and one live repository’s full name (`owner/repository`). This may be a private repository’s name. These fields refresh while the app is installed and may remain after uninstall until reinstall or account deletion; no source code is sent to Stripe. You can update billing information through the billing portal
* **Resend** — sending our emails. It receives your email address and the message
* **Infrastructure providers** — Render (application servers, PostgreSQL and our blog), Neo4j Aura (graph database), Cloudflare (network edge in front of our servers), Vercel (hosting for pharaoh.so, including Vercel Web Analytics on pages our servers render) and GitBook (hosting for pharaoh.so/docs)
* **Google Ads** — optional advertising measurement on our public marketing pages and a minimal purchase-confirmation page, only after you allow it. Our conversion event contains an opaque transaction ID, paid amount and currency. We do not include your GitHub identity, email, repository metadata, card information or Stripe identifiers in this event. Enhanced user-data collection and advertising personalization are disabled. See [Google’s Privacy Policy](https://policies.google.com/privacy) and [how Google uses information from partner sites](https://policies.google.com/technologies/partner-sites).
All providers are bound by their own privacy policies and data processing agreements.
Tool results go to the agent you connect (for example Claude Code, Cursor or Codex). That agent, and the model provider behind it, handle them under their own terms.
### 13. Data Retention
A live repository’s graph is updated on every push. Entries for code you delete stop appearing at once and are removed at the repository’s next full rebuild. When you remove a repository from the GitHub App, we delete its graph. When a repository stops being live, because it was removed from the GitHub App or because an account on a legacy one-repository plan switched its live repository, we delete its graph 30 days later. From Pro's launch, a trial ending does not do that: while your account is unpaid we keep its graphs, and 90 days after the trial or the last subscription ended we stop updating them. When you uninstall the GitHub App, we delete your account, its graphs and its operational data 30 days later; reinstalling before then keeps them. If you ask us to delete your account (section 14), we run that deletion by hand. It removes the same data, along with your Stripe customer record (Stripe keeps the payment records it is required to keep).
Usage logs, connection records, PR Guard check records, mapping-quality records, alert records and site-visit records are deleted after 90 days. Alert records aren’t removed when an account is deleted; they age out on that same 90 days. Sign-in sessions are deleted once their tokens expire (a refresh token lasts a year), and setup and billing sign-in links after 24 hours. Your GitHub identity and email reports are kept while your account exists and are deleted with it, unless you also belong to another Pharaoh account, in which case your own records stay with that account. A record that you unsubscribed or that your address bounced is kept even then, under your GitHub user ID, so we never email you again. Server logs are kept for 14 days, the log retention on our Render plan.
Our hosting providers keep backups for 7 days: Render’s point-in-time recovery for PostgreSQL and Neo4j Aura’s daily graph snapshots. Data we delete can stay in those backups for up to 7 days.
Seat-usage records are deleted after 62 days. Pull request scores are kept for 12 months. Records of which pull requests PR Guard admitted under the daily limit are deleted after 7 days. Your onboarding record and your answers to the onboarding question are kept with your GitHub identity and deleted with it. The record of who pays for an account is kept until that person, or the last account they pay for, is deleted. Deleting your account removes all of these, so no record of a past trial survives it.
The first-payment record is kept while your account exists to prevent repeated payments being reported as new purchases. It is removed with your account data. A Pro payer’s first-payment record is kept the same way, under their GitHub user ID. A pending browser conversion is eligible for reporting for seven days after payment; browser blocking or lack of permission can prevent it from being reported to Google.
Enterprise draft answers and their write credentials expire after 30 days without activity. Anonymous enterprise reporting sessions and events are kept for 90 days from session creation, independently of draft answers; public page/click events are kept for 90 days. Submitted consultation responses, contact details including an optional phone number, follow-up stages and acknowledgement receipts are deleted 90 days after submission. Hashed recipient cooldown and bounce/complaint suppression records are kept for 90 days after their last update. You can request a copy or deletion by emailing the privacy address below; enterprise requests do not require a GitHub account.
### 14. Your Rights
You can: request a copy of your data, ask us to delete your data (uninstall the GitHub App or email us), and update your billing information via the [billing portal](https://pharaoh.so/manage). For any data request, email .
### 15. Cookies
We use session cookies to keep you signed in; `pharaoh_auth`, a signed cookie that remembers your GitHub account for 90 days so you can approve your next device sign-in with one click; and a first-party cookie, `ph_vid`, that holds a random ID for 90 days. Our Install redirect and setup pages use the same `ph_vid` cookie to connect these steps with visits to our public pages. If you later sign in with GitHub, we link that ID to your account, which helps us identify an observed page or campaign that brought you. When we did not observe the original source, we record it as unknown. Our first-party site-visit records do not store IP addresses.
We also store your advertising measurement choice in `ph_ads_consent` for 90 days. Until you allow measurement, we do not load the Google Ads tag or send it measurement requests. If you allow it, Google may set advertising measurement cookies, including cookies whose names start with `_gcl_`, and process the information described above. Advertising personalization and Google Analytics storage remain disabled.
The enterprise form uses your browser's local storage, under `ph_enterprise_intake_v1`, to recover your qualification answers and progress after closing or reloading the form. This entry also holds an unpredictable credential that authorizes only that draft. Unsubmitted contact fields, including an optional phone number, and pending submission details are stored separately in this tab's session storage, under `ph_enterprise_intake_contact_v1`, to recover after a refresh in the same tab. Contact recovery does not extend across tabs or browser restarts. Both browser entries expire after 30 days without activity. Contact fields are sent to our server only when you press **Book a call**. Successful submission clears the browser's contact and qualification copies, retaining only the draft credential and completion metadata to restore the confirmation. Restoring that confirmation does not automatically reopen the booking provider. If browser storage is unavailable, the current page can still save qualification answers on the server and submit, but refresh recovery is unavailable.
**Clear form**, at the bottom left of the form, removes the saved response and draft credential from your browser and starts a new response. It does not delete server-side draft answers, anonymous analytics or an already submitted consultation request; those follow the retention periods in section 13 or a verified deletion request. This policy remains available from the form's Privacy link.
After an eligible purchase, a five-minute cookie, `ph_ads_purchase_attempted`, prevents repeated redirects if advertising measurement is blocked or interrupted. It contains only an attempt flag, not payment or account details.
You can allow or reject measurement, or withdraw permission later, using **Advertising privacy choices** on our public marketing pages. Withdrawing permission removes the advertising measurement cookies we can access and reloads the page so the Google tag is no longer loaded. If your browser cannot save this choice, we show instructions to clear site data and reload. This does not undo information Google already received. Refusing measurement does not affect your ability to use Pharaoh or our existing first-party site-visit measurement.
### 16. Changes to This Policy
We may update this policy. Material changes will be communicated via the email associated with your GitHub account. The “last updated” date at the top indicates when the policy was last revised.
### 17. Contact
Questions? Email (general) or (privacy-specific).