Privacy notice

Spartyx reads your source code. That is the whole product, so this notice is mostly about what happens to it — where it goes, who else sees it, and when it stops existing.

What we collect

Your account

Your email address, and an account identifier. Authentication is handled by Supabase; we do not store your password.

Code you submit for scanning

Whatever you point a scan at: a GitHub repository imported through our GitHub App, an uploaded folder, or a snippet you paste. Dependency manifests and lockfiles are read as part of this.

Scan results

The findings themselves — file paths, line ranges, the lines quoted as evidence, severity, and the advisory data matched against your dependencies. Findings quote your code, so a stored finding contains a fragment of it even when the full source has been discarded.

Device registration

When you register a browser as trusted, we record what that browser reports about itself: user agent, platform, timezone, language, screen size, and similar. This exists so a scan cannot be run from a session you did not approve.

Activity records

Scans started and finished, exports taken, settings changed, and administrative actions. These are kept so that an account can be audited after the fact.

What happens to your source code

Each scan carries a retention choice. When you choose not to retain source, the scan record is written with the source field empty and a deletion timestamp set — the code is not kept after the scan completes. When you do retain it, it stays with the scan record until you delete the scan or the account.

Deleting a scan deletes its stored source. Deleting your account deletes your scans, findings, device registrations and entitlement record.

Deep Review sends code to Google

This is the disclosure that matters most, so it is not buried.

Spartyx has three scan depths. Baseline and Intelligence run on our own infrastructure. Deep Review additionally sends selected source context to Google's Gemini API for analysis. If you do not want your code leaving our infrastructure, do not run Deep Review.

Findings produced this way are labelled as AI-assisted in the report, because a language model is not deterministic and the same code can produce a different result on another run.

Who else processes your data

• Supabase — authentication and the database that holds accounts, scans and findings.
• Vercel — hosting for the website and application.
• Render — the scanning backend.
• Google — the Gemini API, for Deep Review scans only.
• GitHub — only if you install our GitHub App, and only to read the repositories you select.
• OSV (Open Source Vulnerabilities) — dependency advisory lookups. We send package names and versions from your manifests. We do not send your source code.
• Paddle — payments. Paddle is the merchant of record and handles card details directly; we never receive or store them.

What the GitHub App can read

The Spartyx GitHub App requests read access to repository contents and nothing more. It cannot write to your repositories, cannot read issues or pull requests you have not pointed it at, and cannot see repositories you did not select when installing it.

Website scanning

If you use surface scanning against a website, we record the target, what was found, and the authorization you provided. You may only scan a site you own or are authorised to test — see the terms.

Cookies

A session cookie to keep you signed in, and browser storage for interface preferences such as your chosen tab or whether the end-of-scan sound is on. No advertising cookies and no third-party analytics trackers.

Your data, and getting it back or removed

• Export any scan as a PDF from the dashboard at any time.
• Delete individual scans, which deletes their findings and stored source.
• Revoke a registered device, which stops scans from that browser.
• Ask for a copy of your data or for your account to be deleted, by emailing admin@cybertool.dev.

Changes

If this notice changes in a way that affects what happens to your code, the date at the top changes and the change is described here rather than applied quietly.

A note on this document

Every factual claim above was checked against what the software actually does rather than written from a template. It has not been reviewed by a lawyer, and it is not legal advice.