Privacy Policy

1. What this policy covers

This policy explains what data Railo handles and why, for this website, the free Railo GitHub Action, and Fix Sprint and Fix Desk engagements. In it, “we” and “us” means the team that runs Railo.

2. The GitHub Action

The Action runs inside your own GitHub Actions job. Your source code, diffs and findings stay in your CI and your repository; they are not sent to us.

By default the Action sends one usage ping per run, with only these fields: the repository owner and name, the mode, the Action version, a licence identifier and tier if you use one, the number of findings and fixes, the scan duration, and a timestamp. It never includes source code, file contents or finding details. We use it to understand how the Action is used and to improve it. Set RAILO_TELEMETRY=0 in the step's environment and nothing is sent.

3. Fix Sprints and Fix Desk

• We sign your NDA before we receive any access.
• We use only the access you grant, limited to the repositories in scope: read them, and open pull requests. We do not ask for production systems or secrets.
• We work in a private clone used only for your engagement, and delete it when the engagement ends.
• We keep the evidence pack (findings, links to the fix pull requests, and their outcomes) and our correspondence with you as the record of the work. The evidence pack contains no source code. We keep it for as long as your agreement with us says, or until you ask us to delete it.

4. This website

railo.dev uses no analytics, advertising or tracking cookies. Cloudflare, which hosts the site, processes each request (including your IP address) to deliver and protect it. When you email us, we keep the message so we can reply and keep a record of the conversation.

5. The hosted GitHub App

The hosted GitHub App and its dashboard are paused and receive no new data. If you used them before they were paused, email us and we will delete the records we hold about your account.

6. What we never do

• We do not sell, rent or share your data for marketing or advertising.
• We do not use your code to train any model, ours or anyone else's.
• We do not commit to your branches. Every change arrives as a pull request or a suggestion.

7. Who else is involved

GitHub, where your code lives and where the Action runs, under GitHub's own terms and privacy statement. Cloudflare, which hosts this website. Our email provider, for messages you send us. We share data with no one else, except where the law requires it.

8. Your choices

You can ask us what we hold about you or your organisation, ask us to correct it, or ask us to delete it. Email zarif.latif@railo.dev and we will reply.

9. Security

How we handle code is described in Security and data handling. To report a vulnerability in Railo, follow the security reporting policy.

10. Changes

If this policy changes, we will update it here and change the date at the top. Questions about it go to zarif.latif@railo.dev.