> For the complete documentation index, see [llms.txt](https://pharaoh.so/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://pharaoh.so/docs/use-pharaoh/terms-and-privacy.md).
# Terms and privacy
Pharaoh's terms of service and privacy policy: what we collect, how long repository metadata is kept, billing terms and how to request deletion.
Last updated: October 30, 2026
[Terms of Service](#terms) · [Privacy Policy](#privacy)
## Terms of Service
### 1. What Pharaoh Does
Pharaoh (“we”, “us”, “the Service”) provides codebase intelligence via MCP (Model Context Protocol) tools. We parse your repositories into knowledge graphs that AI coding tools can query. A graph holds structure (names, file paths, dependencies, complexity scores) and excerpts such as function signatures and doc comments; section 9 describes what it holds. **We never store source code.**
### 2. Account & Access
You authenticate via GitHub OAuth. By using Pharaoh, you confirm you have authority to grant read access to the repositories you connect. We verify organization membership on every token refresh. Access is scoped to your GitHub organization or personal account.
### 3. Billing
Subscriptions are billed monthly via Stripe. Current pricing for team/organization and personal accounts is listed on our [pricing page](https://pharaoh.so/#pricing). PR Guard is included in every paid plan with no per-repo add-on charges. Prices may change with 30 days notice. You can cancel anytime through the [billing portal](https://pharaoh.so/manage)—access continues through the end of your current billing period. No refunds for partial months.
### 4. What We Store
We store: repository metadata and excerpts, your GitHub identity, records of how you use the Service (all listed in section 9), and billing records (Stripe handles payment; we never see card numbers). We do **not** store source code, file contents, function bodies, or environment variable values (see section 10).
### 5. Data Isolation
Your data is isolated through application-level controls: every graph query is scoped to your repositories, and repo ownership is verified against your account before each request. Your architectural data is never visible to other customers.
### 6. Acceptable Use
Don’t use Pharaoh to: reverse-engineer others’ codebases without authorization, circumvent access controls, or resell access. We may suspend accounts that violate these terms.
### 7. Availability & Liability
We aim for high availability but don’t guarantee uptime. Pharaoh is provided “as is.” Our total liability is limited to the amount you’ve paid us in the last 12 months. We are not liable for decisions made by AI tools based on Pharaoh’s data.
### 8. Changes to Terms
We may update these terms. Material changes will be communicated via the email associated with your GitHub account at least 14 days in advance. Continued use after changes take effect constitutes acceptance.
## Privacy Policy
Pharaoh is operated by 2407066 Alberta Inc. This policy explains what data we collect, why, and how we protect it.
### 9. Data We Collect
| Category | What | Why |
| -------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------- |
| GitHub identity | GitHub user ID, username, display name and avatar URL; your email address (see below); organization membership and repository access; installation ID | Authentication, authorization, tenant isolation |
| Repository metadata | Repository names, the ID of the latest mapped commit and the repository’s `.pharaoh.yml` settings, if it has that file; function, class and constant names; file paths, module boundaries and package names; which files import each other, which functions call each other and which classes extend which; complexity scores, line counts and line ranges, whether a function is exported or async, and whether a file is a test; function signatures as written, including parameters, types, default values and return types, with no length limit, so a default value can include code; up to 200 characters of each doc comment or Python docstring; one-way hashes of function bodies; values of top-level constants (TypeScript and JavaScript strings and numbers of up to 128 characters, skipping constants named KEY, SECRET, TOKEN, PASSWORD or CREDENTIAL, or ending in `_KEY`, `_SECRET`, `_TOKEN`, `_PASSWORD` or `_CREDENTIAL`, in any case) and their type annotations; HTTP routes and methods, cron schedules, database table names, event names and environment variable names; each file’s last-modified date and how often it changed in the last 90 days; and import paths a map couldn’t resolve | Knowledge graph construction (our core service) |
| Billing | Stripe customer ID, subscription status, and a record of the first paid Personal or Team subscription for each billed GitHub account, including invoice reference, amount, currency and an opaque transaction ID | Subscription management and preventing duplicate purchase measurement |
| Usage logs | For each MCP tool call: the tool, the arguments your AI client sent (such as repository names, search terms and function names), when it ran and how long it took, the response size, any error, your GitHub user ID and username, and the session ID. A text argument longer than 500 characters is cut to 500 (text inside a list argument is stored in full), and arguments named token, password, secret, key, authorization or credential are replaced with `[REDACTED]`. For each PR Guard check: the pull request number, the commit checked and the result. Milestones such as your first sign-in, first map and first tool call | Recording rate-limit refusals, debugging, audit trail, onboarding, scheduling map refreshes, product analytics |
| Connection records | For each MCP session, the name and version your AI client reports (for example `claude-code` and its version number) and the connection type; through the npx proxy, also the client running it and whether the Pharaoh plugin is enabled. For device sign-ins, the IP address and user agent of the `/device` request and of one-click approvals on `/activate` | Support, client compatibility, abuse detection |
| Server logs | Application logs of sign-ins, errors and refused requests, with GitHub usernames and IDs, repository names and, for some requests, an IP address or user agent | Debugging and security |
| Alert records | Internal alerts about mapping, account and billing problems, which can name an account, a repository or a GitHub username | Operating and monitoring the service |
| Site visits | A random visitor ID kept in a cookie; the pages and page sections you view; how far you scroll (25, 50, 75 and 90%); how long a page stays in the foreground (10, 30 and 60 seconds); which Install or setup button you click and the plan it’s for; which copy button you use, never what you copy; whether the FAQ comes into view, which entries you open and which links in them you click; whether you change the pricing calculator or open its assumptions, never the values you enter; the site or page that sent you; and any campaign tags in the link | To learn which channels bring people who go on to use Pharaoh and how they use our pages |
| Optional advertising measurement | If you allow it, Google Ads processes visits to and interactions with our public marketing pages, such as scrolling and link clicks, ad-click identifiers and cookie identifiers, along with browser and network information such as your IP address. For a completed first Personal or Team purchase, we also send an opaque transaction ID, the paid amount and its currency. | To measure our Google Ads campaigns and paid conversions; advertising personalization is disabled |
When you sign in with GitHub we store your primary verified GitHub email. We use it for at most two setup emails (one when your first map is ready, one reminder if you haven't connected an AI client after three days), each with a one-click unsubscribe, and as the email on your account’s Stripe customer record (section 12). Our email provider, Resend, tells us whether each email was delivered, bounced, opened or clicked; for a click, its report includes the IP address and browser that clicked. We keep those reports with your unsubscribe choice.
### 10. Data We Do NOT Collect
**Source code.** To map a repository or check a pull request, we clone it into a temporary directory on our servers and delete that directory when the job ends, including when the job fails. We don’t store source code, file contents, function bodies, comments other than the first 200 characters of each doc comment, environment variable values, commit messages, authors or diffs. The [open-source parser](https://github.com/Pharaoh-so/pharaoh-parser) shows what is extracted from function, class and constant definitions; section 9 lists the rest. **Credit card numbers.** Payment is handled entirely by [Stripe](https://stripe.com/privacy). We never see or store card details.
### 11. How Data Is Stored
Repository metadata is stored in Neo4j (graph database) with query-level isolation per customer. Operational data (account records, repository names and mapping status, sign-in sessions, usage logs) is stored in PostgreSQL, along with mapping-quality records, which can include import paths a map couldn’t resolve. Both are hosted on infrastructure with encryption at rest and in transit. On top of that, we encrypt a few fields ourselves with AES-256-GCM: GitHub tokens before storage, and function signatures, doc comments and constant values with a key derived for your account before they enter the graph. The rest of the repository metadata in section 9 (names, file paths, modules, dependencies, HTTP routes, complexity scores) has no encryption beyond the hosting providers’. Pharaoh’s own access and refresh tokens are stored only as SHA-256 hashes.
### 12. Data Sharing
We do not sell your data. We share data only with:
* **GitHub** — sign-in, repository access, looking up your public profile name and avatar, and the check results PR Guard and setup post to your repositories
* **Stripe** — billing and payment processing. When you install the GitHub App, we create a Stripe customer for the account, whether or not it subscribes, with the account name, the Pharaoh account ID and whether it is a personal or organization account. If that fails, we create it later, when someone signs in or checks out. Each time someone with a verified GitHub email signs in to the account from an AI client or the billing page, including a repository collaborator, we set the customer’s email to their primary verified GitHub email, replacing the one before. Signing in on the setup page and approving a device with one click don’t change it
* **Resend** — sending our emails. It receives your email address and the message
* **Infrastructure providers** — Render (application servers, PostgreSQL and our blog), Neo4j Aura (graph database), Cloudflare (network edge in front of our servers), Vercel (hosting for pharaoh.so, including Vercel Web Analytics on pages our servers render) and GitBook (hosting for pharaoh.so/docs)
* **Intercom** — the support chat on pharaoh.so. Its script loads as soon as the page is idle (within five seconds), or at your first scroll, click, tap or keypress if that comes first. Intercom then receives your browser and network details, such as your IP address and the page you’re on, and anything you type into the chat
* **Google Ads** — optional advertising measurement on our public marketing pages and a minimal purchase-confirmation page, only after you allow it. Our conversion event contains an opaque transaction ID, paid amount and currency. We do not include your GitHub identity, email, repository metadata, card information or Stripe identifiers in this event. Enhanced user-data collection and advertising personalization are disabled. See [Google’s Privacy Policy](https://policies.google.com/privacy) and [how Google uses information from partner sites](https://policies.google.com/technologies/partner-sites).
All providers are bound by their own privacy policies and data processing agreements.
Tool results go to the AI client you connect (for example Claude Code, Cursor or Codex). That client, and the model provider behind it, handle them under their own terms.
### 13. Data Retention
A live repository’s graph is updated on every push. Entries for code you delete stop appearing at once and are removed at the repository’s next full rebuild. When you remove a repository from the GitHub App, we delete its graph. When a repository stops being live, for example after you move to the free plan, we delete its graph 30 days later. When you uninstall the GitHub App, we delete your account, its graphs and its operational data 30 days later; reinstalling before then keeps them. If you ask us to delete your account (section 14), we run that deletion by hand. It removes the same data, along with your Stripe customer record (Stripe keeps the payment records it is required to keep).
Usage logs, connection records, PR Guard check records, mapping-quality records, alert records and site-visit records are deleted after 90 days. Alert records aren’t removed when an account is deleted; they age out on that same 90 days. Sign-in sessions are deleted once their tokens expire (a refresh token lasts a year), and setup and billing sign-in links after 24 hours. Your GitHub identity and email reports are kept while your account exists and are deleted with it, unless you also belong to another Pharaoh account, in which case your own records stay with that account. A record that you unsubscribed or that your address bounced is kept even then, under your GitHub user ID, so we never email you again. Server logs are kept for 14 days, the log retention on our Render plan.
Our hosting providers keep backups for 7 days: Render’s point-in-time recovery for PostgreSQL and Neo4j Aura’s daily graph snapshots. Data we delete can stay in those backups for up to 7 days.
The first-payment record is kept while your account exists to prevent repeated payments being reported as new purchases. It is removed with your account data. A pending browser conversion is eligible for reporting for seven days after payment; browser blocking or lack of permission can prevent it from being reported to Google.
### 14. Your Rights
You can: request a copy of your data, ask us to delete your data (uninstall the GitHub App or email us), and update your billing information via the [billing portal](https://pharaoh.so/manage). For any data request, email .
### 15. Cookies
We use session cookies to keep you signed in; `pharaoh_auth`, a signed cookie that remembers your GitHub account for 90 days so you can approve your next device sign-in with one click; and a first-party cookie, `ph_vid`, that holds a random ID for 90 days. If you later sign in with GitHub, we link that ID to your account, which is how we know which page or campaign brought you. Our first-party site-visit records do not store IP addresses.
We also store your advertising measurement choice in `ph_ads_consent` for 90 days. Until you allow measurement, we do not load the Google Ads tag or send it measurement requests. If you allow it, Google may set advertising measurement cookies, including cookies whose names start with `_gcl_`, and process the information described above. Advertising personalization and Google Analytics storage remain disabled.
Intercom, which runs the support chat on pharaoh.so, sets its own cookies, with names starting with `intercom-`, to recognize your browser and keep any conversation you start.
After an eligible purchase, a five-minute cookie, `ph_ads_purchase_attempted`, prevents repeated redirects if advertising measurement is blocked or interrupted. It contains only an attempt flag, not payment or account details.
You can allow or reject measurement, or withdraw permission later, using **Advertising privacy choices** on our public marketing pages. Withdrawing permission removes the advertising measurement cookies we can access and reloads the page so the Google tag is no longer loaded. If your browser cannot save this choice, we show instructions to clear site data and reload. This does not undo information Google already received. Refusing measurement does not affect your ability to use Pharaoh or our existing first-party site-visit measurement.
### 16. Changes to This Policy
We may update this policy. Material changes will be communicated via the email associated with your GitHub account. The “last updated” date at the top indicates when the policy was last revised.
### 17. Contact
Questions? Email (general) or (privacy-specific).