Privacy Policy

Last updated: May 26, 2026

Overview

Athena CI/CD ("Athena", "we", "our") is a GitHub App that analyzes pull request metadata to optimize CI/CD pipeline execution. This policy explains what data we collect, how we use it, and your rights.

Data We Collect

When installed on a repository, Athena receives webhook payloads from GitHub containing:

• Pull request metadata — PR number, title, author username, labels, branch names, commit SHAs
• File change metadata — File names, paths, additions/deletions counts, and file status (added, modified, removed)
• Repository metadata — Repository name, owner, default branch, visibility
• Installation metadata — GitHub App installation ID, account name
• CI workflow results — Workflow names, job names, run conclusions (success/failure), run durations

Data We Do NOT Collect

• Source code — Athena does not read, download, or store file contents, diffs, or patches
• Secrets or credentials — We do not access repository secrets, environment variables, or tokens
• Personal data beyond GitHub usernames — We do not collect email addresses, real names, or other PII
• Issue or discussion content — We only process PR-related events

How We Use Data

Data is used exclusively to:

• Classify changes and determine the intent of pull requests
• Generate optimized CI execution plans
• Create GitHub Check Runs with analysis results
• Detect failure patterns and compute module health scores
• Improve routing decisions for future pull requests on the same repository

Data Storage

Webhook event metadata and analysis results are stored in a PostgreSQL database hosted on Railway. Data is retained for operational purposes (debugging, learning improvements) and is not shared with third parties.

Data Sharing

We do not sell, rent, or share your data with third parties. Analysis results are only written back to GitHub as Check Runs on your pull requests.

Data Retention

Webhook event records and analysis data are retained indefinitely for the purpose of improving Athena's routing intelligence. You may request deletion of your data by contacting us.

Security

• All webhook payloads are verified using HMAC-SHA256 signatures
• GitHub API authentication uses short-lived installation tokens (1 hour TTL)
• Database connections use TLS encryption
• The application runs in isolated containers with non-root users

Your Rights

You can:

• Uninstall — Remove Athena from your repositories at any time via GitHub Settings
• Request data deletion — Contact us to delete all stored data for your repositories
• Request data export — Contact us for a copy of the data we hold about your repositories

Changes to This Policy

We may update this policy from time to time. Significant changes will be communicated through our GitHub repository.

Contact

For privacy-related inquiries: privacy@athena-cicd.dev

GitHub: github.com/Yovanyss/athena-cicd