Privacy Policy

What Foreman stores

• Your account. Sign-in is handled by Clerk, which holds your email address, name and sign-in methods. Foreman keeps your Clerk user ID to link your data to you.
• Encrypted credentials. The Claude Code OAuth token or Anthropic API key, GitHub token and OpenCode API key you save. Each is encrypted with AES-256-GCM, tied to your user ID, and stored in Cloudflare KV with its type, last four characters and when it was updated. It is decrypted only to start your runs.
• Run records. For each run: the repository, issue number and title, status, start and finish times, pull request link and exit reason, stored in Cloudflare KV under your user ID.
• Usage records (metering). For each run: run and session IDs, your user ID, machine size, start and end times, outcome, and the compute used and its cost. These are used for run limits and billing.
• Operational logs and traces. Service logs and traces kept for 14 days in Grafana Cloud, used to keep Foreman running.

What Foreman never stores

• Your credentials in plain text, in responses or in logs.
• Your repository code. It is cloned into a temporary container for the run and is not kept by Foreman after the run. The results live in the pull request on GitHub.
• Your card number. Payments are handled by the payment processor.
• Foreman does not sell your data or use it to train models.

Deleting your data

• Remove any saved credential yourself on the Settings page. It is deleted from storage immediately.
• To delete your account, run records and usage records, send a request through contact us. We delete them and confirm.

Who handles your data

Clerk (sign-in), Cloudflare (hosting and storage), Grafana Cloud (logs), your chosen model provider and GitHub (during runs), and the payment processor.