Covalentteam is provided by Green Guava Tree. This policy says what the Service reads, what it stores, how long it keeps it and how to get rid of it. It covers covalentteam.com and the Covalentteam GitHub App.
What we read when you sign in
You sign in with GitHub, and the Service asks GitHub for two things and nothing else:
- To know you between visits
- Your GitHub account and the handle your colleagues know you by.
- To be able to write to you
- Your email address, and nothing is sent to it but what your account does.
Neither of those reaches your source code, and nothing we ask for ever does. What keeps you signed in stays in your own browser and never travels in a link.
What the GitHub App reads
When you install the Covalentteam GitHub App on an organisation, GitHub tells it that three things happened, and it listens for nothing else:
- A pull request moved. The signal taken from it is who opened it, what it is called and where it lives, who was asked to review it, whether it is still a draft, how large the change is and when it happened — never a line of the change itself.
- Somebody reviewed one. Who reviewed what, and when.
- An issue was picked up or put down. The same signal a pull request gives.
The App never opens your code. It cannot read a repository’s contents or the diff of a change, and what it does take is the signal above, which is what the team view is assembled from.
What you give us directly
- One-to-one notes and follow-ups you write in the product.
- Documents you attach to a colleague or a conversation, which nobody outside your organisation can reach.
- Your place on the waiting list, if you asked for one before the product was open.
How long we keep it
Activity read from GitHub lives for one month and then ages out. Nothing older than that is kept, and nothing older than that is read. Notes, documents and account records are kept until you erase them.
Erasing it
The admin screen erases rather than hides. Erasing a team removes that organisation’s activity; erasing an account does that and then removes the account. Neither leaves a marker behind standing in for what was there, and neither is reversible — which is the point of it.
Who else sees it
We do not sell your data and we do not use it to train models. It is not shared with anyone outside the processors that run the Service:
- Cloudflare
- Runs the Service, holds what it keeps, and carries the email it sends you.
- GitHub
- Signs you in, and is where the activity the product reads comes from.
If you subscribe your own calendar to your meetings, the calendar app you choose fetches them from a private address: each meeting’s title, when it is, and whom it is with, and never what was written in it. Anyone holding that address can read the same, so keep it to yourself.
Email we send
We write to the address on your account about things that happened to your account — a place on the waiting list, an invitation, a welcome, and confirmation when you erase a team or an account. We do not send marketing email.
Your colleagues
A team view is assembled from the activity of people who have not themselves signed in. Their GitHub handle and the signal above is what appears. If you are on a team in Covalentteam and want to know what is held about you, or want it removed, write to us and we will deal with you directly rather than through your manager.
Your rights
You can ask for a copy of everything we hold about you, have it corrected, or have it erased, and none of that depends on where you live. The admin screen erases the moment you ask it to; for a copy or a correction, write to us and we will do it.
Changes
The date above is when this policy last changed. A change that alters what we read or how long we keep it will be sent to the address on your account before it takes effect.
Reaching us
Privacy questions, access requests and erasure requests all go to the same address.