> privacy.md
Privacy Policy
Your code stays yours. We index customer repositories to make them searchable and useful to your agents. We do not train on your code, sell it, or expose it to other customers.
Effective March 23, 2026. This page covers customer repository data and service data. Public website crawl permissions are separate and do not apply to private code.
tl;dr — Your code stays yours. We index customer repositories to make them searchable. We do not train on customer code, sell it, or show it to other customers. Public website AI crawl permissions do not apply to customer repositories.
1. Who We Are
Maguyva is a code intelligence service operated by UT INTERNATIONAL PTE. LTD., a company registered in Singapore.
2. What We Collect
We collect three categories of data:
- Account data: your name, email address, and GitHub OAuth token (used to access repositories you authorize)
- Code data: your source code (stored to serve file content and power search), abstract syntax trees, symbol graphs, and semantic embeddings derived from your code
- Usage data: which tools you call, timestamps, and aggregate query patterns
Browser Storage. This website stores a small amount of data in your browser's local storage to remember your color mode preference (key: "maguyva-color-mode"). If you trigger the optional CRT easter egg, the active visual theme is stored in session storage for the current tab only. This data never leaves your browser and is not transmitted to our servers. We do not use cookies for tracking or analytics. Cloudflare, our infrastructure provider, may set functional cookies for security purposes. For aggregate usage analytics we use Umami, a privacy-friendly, cookieless analytics service that sets no cookies and does not collect personally identifiable information.
3. How We Use It
We use your data to index your code and serve code intelligence features, process payments via Stripe, send transactional emails (account confirmations, billing receipts), and compute aggregate usage statistics. We do not use customer code to train machine learning models. We do not sell your data.
4. Your Code
When you connect a repository, your source code is stored in our service infrastructure to power code intelligence features including file retrieval and search. We parse code with tree-sitter, generate semantic embeddings through Voyage AI, and build a symbol graph of definitions and references. The embedding request sends AST-aware semantic chunks, not complete files or repositories, and excludes customer-identifying metadata such as repository names, usernames, organization identifiers, and file paths. Those chunks are used to generate embeddings under API terms and account settings that do not permit training on customer data. Source and derived index data are stored in PostgreSQL in the forms needed for file retrieval, search, and graph analysis. Product access is controlled through organization- and namespace-scoped access controls; Maguyva operators may access repository data only as needed to operate, secure, or support the service. When you disconnect a repository or cancel your account, active indexed source code and derived data are removed from service systems, with residual backup copies expiring within the backup retention window.
5. Third Parties
We use the following services to operate Maguyva:
- Supabase (database hosting, AWS US regions)
- Cloudflare (CDN, edge compute, DNS)
- Voyage AI, now part of MongoDB (embedding generation - receives AST-aware code chunks without customer identifiers, not complete files or repositories)
- Stripe (payment processing)
- GitHub (OAuth authentication and repository access)
- Umami (cookieless website usage analytics - aggregate metrics only, no personally identifiable information)
6. Data Security
Data is transmitted over HTTPS/TLS. Indexed repository data is stored on managed infrastructure with storage-level encryption at rest. Source and derived index data remain readable to the service where required for search, file retrieval, support, and security operations. Repository access is controlled through organization- and namespace-scoped access controls. API keys are validated against stored metadata and repository access restrictions.
7. Your Rights
Under Singapore PDPA and EU GDPR (where applicable), you have the right to:
- Access the personal data we hold about you
- Correct inaccurate data
- Request deletion of your data and indexed repositories
- Export your account data
- Object to processing or withdraw consent
8. Data Retention
Active accounts: data is retained while your account is active. Removed repositories and deleted accounts: active indexed source code and derived data are removed within 30 days, with residual backup copies expiring within 90 days. Billing records are retained for 7 years as required by law.
9. Changes and Contact
We will email you about material changes to this policy. For questions or data requests, contact privacy@maguyva.ai.