Privacy

The launch list

• What we store. When you leave your email on the Register page: the email address, the language the page was in, which consent line you were shown and its exact words, and when you signed up. Your network address is counted in memory to limit repeated sign-ups; it isn't saved with your email.
• Why. To email you once, when the Branchscope beta launches. Nothing else.
• No email yet. Nothing is sent when you sign up, and Branchscope sends no email from the list today.
• Who can see it. Only Branchscope's site administrators, who can see how many people are on the list and download it.
• How long. There's no automatic deletion yet: your email is kept until you ask us to remove it.
• Removal. To be removed, write to us.
• Where. On servers Branchscope runs. Where they are: Due diligence.

Accounts

• Signing in. You sign in through Keycloak. Branchscope keeps the username, email address and name it gives, when your account was created and when you last signed in.
• Your profile. What you add yourself: a display name, bio, pronouns, location, website, links and avatar.
• Sign-in records. Keycloak records each sign-in, with the address it came from, and keeps the record for 30 days. Failed sign-ins are recorded too. Site administrators see the country a sign-in came from, worked out on our own servers from a database we hold; your IP address isn't shown to them in Branchscope, and isn't sent anywhere.
• Account emails. Invitations, password resets and email verification are sent through Resend (Resend, Inc.) from its EU region. Resend receives the recipient's email address, name and the message, which contains a single-use link, only to deliver it.
• Audit log. Changes to security settings record who made them and when. There's no deletion period for these yet.
• Your work. The repositories, changes, reviews and comments you make, each attributed to you.
• Repository traffic. When you open a repository's pages or clone it, the visit is counted for its owners without a cookie: your address and browser are made into a hash, with a salt made each day and kept in memory, only to count you once that day; neither is stored. The site that linked you there is kept by its name, with the day's counts, for a year.

To have your account removed, write to us.

Where Branchscope is hosted and what it depends on: Due diligence.

Cookies

The web app sets only these cookies, each needed for the site to work or to remember a choice you made. There are no advertising or analytics cookies, and the site loads no scripts or fonts from other services.

• bsc_session: keeps you signed in. Set when you sign in, removed when you sign out; lasts up to 30 days.
• bsc_oidc: holds the sign-in in progress and the page to come back to. Set when you start signing in, removed when it finishes; lasts up to 10 minutes.
• bsc_locale: the language you chose. Set only when you pick one; lasts a year.
• branchscope-theme: light or dark, if you chose one. Removed when you go back to the system setting; lasts a year.
• branchscope-namespace: the organization you're working in, signed in. Set when you choose one in the switcher or open one of your organizations' pages; lasts a year.
• branchscope.code-view: the Code tab's view you last chose. Lasts a year.
• sidebar_state: whether the app's sidebar is open. Set when you open or close it; lasts 7 days.
• bsc_import_closed: keeps a finished import's card closed once you close it. Lasts 5 minutes.
• payload-theme and payload-lng: the theme and language a site administrator chooses in the docs editor (/site-admin/cms). Last a year.

Keycloak, which runs the sign-in pages, sets its own cookies there while you sign in.