Privacy Policy

1. Overview & Privacy Commitment

At RepoPrep ("we", "us", "our", or "Sirora Tech"), we prioritize developer privacy and source code confidentiality. We understand the proprietary nature of software repositories and maintain strict boundaries around how code is analyzed, stored, and protected.

2. Information We Collect

We collect information you provide directly and through automated integration:

• Account & Profile Information: GitHub username, email address, display name, user ID, and avatar URL obtained via GitHub OAuth.
• GitHub OAuth Credentials: OAuth access tokens and refresh tokens granted during sign-in to fetch repository trees on your behalf. All GitHub tokens are stored exclusively in encrypted form using AES-256-GCM.
• Repository Metadata: Repository name, owner login, default branch, public/private status, programming languages, commit SHAs, directory structures, and package dependencies.

3. Repository Code & AST Processing

When you initiate repository analysis, RepoPrep downloads an ephemeral clone of the repository to an isolated analysis worker:

• Deterministic AST Parsing: Our syntax analyzer parses files into Abstract Syntax Trees (AST) to extract exported functions, classes, API routes, database schemas, and architectural connections.
• Derived Knowledge Storage: We store structured architectural facts, symbol references, file importance tiers, and execution flow blueprints in our PostgreSQL database.
• Temporary Storage: Raw cloned repository files on worker nodes are purged after analysis is complete.

4. AI Inference & Third-Party LLM Providers

RepoPrep currently uses Google Gemini as its AI provider to synthesize component summaries, generate interview reasoning questions, and evaluate candidate answers.

Context Bounding: We do not transmit entire codebases to AI models. Only minimal targeted code snippets, AST symbols, and architectural metadata strictly required for the immediate query or evaluation are transmitted.

Enterprise Data Handling: We route AI requests through commercial enterprise API endpoints that guarantee that customer input data is not used for AI model training.

5. Interview, Voice & Evaluation Data

When you use the Interview, Practice, or Mock Interview workspaces, we store:

• Your submitted text answers and study notes.
• Audio buffers recorded during voice mode (temporarily processed for speech-to-text transcription).
• AI evaluations, multi-dimensional scores (Technical, Project Understanding, Completeness, Communication, Confidence), and identified weak conceptual areas.

6. Payment & Billing Data (Razorpay)

Subscription payments, invoicing, and renewals are handled directly by our certified payment gateway partner, Razorpay.

RepoPrep stores customer mapping IDs (e.g. `providerCustomerId`, `providerSubscriptionId`), plan codes, and consumption ledgers. RepoPrep never sees, handles, or stores raw credit card numbers, debit card PINs, CVVs, or banking credentials on our servers. All financial transactions are processed on Razorpay's PCI-DSS Level 1 compliant infrastructure.

7. Cookies & Session Management

RepoPrep uses strictly necessary first-party cookies for platform operation:

• repoprep_session: Secure, HTTP-only cookie maintaining your authenticated user session (duration: 7 days).
• repoprep_oauth_state: Short-lived cryptographic token preventing Cross-Site Request Forgery (CSRF) during GitHub login.
• repoprep_pkce_verifier: Short-lived PKCE code verifier ensuring secure OAuth authorization code exchange.

We do not use invasive third-party cross-site advertising tracking cookies.

8. Third-Party Infrastructure Providers

We partner with trusted enterprise cloud providers to deliver the Service:

9. Data Security & AES-256-GCM Encryption

We employ comprehensive technical and organizational security controls:

• Encryption in Transit: All data transmitted between your browser, our API, and third-party providers is encrypted via TLS 1.3.
• Encryption at Rest: All GitHub OAuth access and refresh tokens are encrypted using AES-256-GCM with unique 16-byte initialization vectors and cryptographic authentication tags.
• Multi-Tenant Isolation: Strict authorization guards enforce project and organization isolation, preventing cross-tenant data access.

10. Data Retention & Permanent Deletion

Your account data, project intelligence, and practice history are retained while your account remains active.

Project Deletion: Deleting a project permanently deletes all associated AST data, domain models, API routes, database schemas, interview question banks, practice attempts, and AI chat histories from our database.

Account Deletion: Deleting your account terminates active subscriptions and permanently purges your user profile, OAuth tokens, and owned projects.

11. Your Privacy Rights & Choices

Depending on your jurisdiction, you have the right to:

• Access and review the personal information we hold about you.
• Request rectification of inaccurate account details.
• Request the complete deletion of your personal data and project records.
• Revoke GitHub repository access permissions at any time via your GitHub Account settings.