Privacy
Written against how Mendr actually works — not generic promises. Mendr is in public beta from 20 September 2026 and is operated by the maintainer of github.com/ajitheee/mendr; the App runs at mendr-app.onrender.com. The authoritative, code-level detail is in TRUST.md.
Where the scan runs
Mendr scans your repository inside your own GitHub Actions runner. The CLI reads your code, a signed registry of provider retirement dates (OpenAI, Anthropic, Google), and your local git. Scans run on every push, every pull request, a daily schedule and on manual dispatch. The audit itself makes no network calls — that is enforced in code (--offline, and a build-time test that runs the audit under a network-blocking preload), not just asserted here. The workflow Mendr generates adds exactly one outbound request: a GET of the signed registry (three public files on GitHub) so the scan runs against current retirement dates. That request carries nothing about you or your repository. If the registry is stale or its signature does not verify, the scan reports inconclusive, never clean.
What leaves your environment
With the standalone CLI or the tracking-issue workflow: nothing about your repository leaves — the report is printed, or written to one GitHub issue in your own repository.
If you connect the Mendr GitHub App, your workflow sends it a signed findings report per scan: provider, model ids, the file path and line of each call site, retirement dates, confidence flags, secret-redacted snippets of at most seven lines, line hashes, result counts, and which registry the scan used. If you later approve a migration, your CI also sends the migration outcome, the branch name and pull-request number, the registry it used, and a redacted diff hunk of the proposed swap (only diff-shaped content, secrets removed, capped at 100,000 characters, shown on the finding so you can see what changes without the App ever opening your repository; you can turn the diff off in the workflow). Never a whole file, never a clone, never a key. Both uploads are authenticated by the run's GitHub OIDC token, so there is no secret to store. The App holds checks: write and metadata: read, plus an optional actions: write you can grant so that clicking Approve starts your migration workflow at once (without it, that workflow's own schedule picks approvals up). It holds no contents permission and cannot read repository contents.
What the App stores
| Data | Kept |
|---|---|
| Which account installed the App, and which repositories it covers (ids, names) | while installed |
| Per audit run: commit, timestamps, conclusion, the GitHub login that triggered the run, the findings (paths, line numbers, classifications, redacted snippets), the result counts, and which registry the scan used — findings encrypted at rest | see retention below |
| Per migration run: commit, outcome, branch name and PR number, registry provenance, and the redacted diff hunk of the swap — encrypted at rest | see retention below |
| Acknowledgements: the GitHub login that acknowledged or cleared a finding, the owner label and note typed in (free text, up to 80 and 400 characters), and when | until the repository's data is deleted |
| Approvals: the GitHub login that approved a migration, when, its status, and the progress timeline your CI reported (stage names, file paths, PR number — never code) | until the repository's data is deleted |
| A security audit log of events (installs, audits received, acknowledgements, approvals, deletions): event name, ids, counts, the GitHub login that acted, and for acknowledgements the owner label typed in — never findings or code | kept after uninstall, for incident response (see below) |
| Only if you join the early-access waitlist: the email you typed, your two answers (does your product call an LLM provider from its code; do you want your repo checked before October 23), the optional note you added, and when you signed up. No IP address, cookie or device detail, and not linked to any installation or repository | until you ask us to remove it: reply "remove" to any email from us |
Not stored, ever: your source code, your GitHub tokens (your sign-in token lives only in an encrypted browser cookie), installation tokens (minted in memory, never written down), or provider API keys (Mendr never receives one). The findings and migration reports are encrypted at rest, field by field (AES-256-GCM), with a key held outside the database; /healthz on the App reports whether that encryption is on. The other fields — repository names, GitHub logins, acknowledgement notes, approval records and the audit log — are stored in plain form in the database.
Personal data, and why
The personal data Mendr holds is your GitHub login (username) and account name — from sign-in, from the run that sent a report, and on any acknowledgement or approval you make — plus whatever you type into an acknowledgement's owner and note fields. No email address, real name or other profile field is stored for anyone using the App or the CLI (the one exception is below: an email you give the early-access waitlist yourself); sign-in uses GitHub OAuth and the session lives only in an encrypted, HttpOnly cookie, which is the one cookie the App sets (this static site sets none). Mendr uses this data for a single purpose: to run the service you installed — showing who triggered a run, who acknowledged or approved what, and reconstructing events if something goes wrong. It is not used for marketing, not sold, and not shared beyond the providers listed under Third parties.
How long, and how to delete it
- Uninstall the App → every run, migration report, approval, acknowledgement and repository record for that installation is deleted immediately (verified on a real uninstall). Reinstalling restores nothing. What remains: a deletion record (installation id, account login, date) and the audit-log entries.
- Remove a repository from the installation → its runs, migration reports, approvals and acknowledgements are deleted.
- Delete on demand → from a repository's page in the App, "Delete stored data" removes its runs, migration reports, approvals and acknowledgements at any time.
- Retention → otherwise data is kept while the App is installed. The App keeps at most the newest 100 audit runs and 100 migration reports per repository; older ones are deleted as new ones arrive. The beta does not apply a time limit on top of that; if one is added, this page will state the number of days. Audit-log entries (ids, counts, logins) are kept for incident response and are not deleted on uninstall; Mendr deletes an account's entries on request (see Your rights).
Who can see your findings
Only people GitHub confirms can access the repository. Signing in proves who you are; the App checks your GitHub access on every view. Findings for a repository are never shown to anyone GitHub does not already let into that repository. Mendr's operator can reach the database and the encryption key in order to run the service and respond to incidents; there is no other access.
Third parties
Mendr's hosted App talks only to the GitHub API (to write the check, confirm your access, look up which of its installations covers a repository your CI uploads from when it has no record of that repository, and — only if you granted actions: write — start your migration workflow). Sign-in is GitHub OAuth; only your GitHub login is kept. There is no analytics SDK, advertising, or third-party tracking on the App. Fonts on this marketing site load from Google Fonts, which sees the requesting browser's IP address.
Four providers process data on Mendr's behalf, and no others:
| Provider | What |
|---|---|
| Render | Hosts the App, which receives and serves everything in the table above |
| Neon | Hosts the App's Postgres database in AWS US East 2 (Ohio), where everything in the table above is stored |
| Vercel | Hosts this static site |
| GitHub | Sign-in (OAuth), the App installation, check runs, and the OIDC tokens that authenticate uploads |
If a provider is ever added, it is added here first.
Your rights
You can see everything the App holds about a repository on that repository's page, delete it yourself with the routes above, and sign out to end your session. For anything you cannot do yourself — a copy of your data, a correction, deleting your username or audit-log entries, or a question about this page — contact Mendr privately through GitHub's private vulnerability reporting for the repository (the one private channel today); expect a reply within three business days. If you are in the UK or EU you have rights of access, correction, erasure, restriction and objection, and can complain to your data-protection authority; California residents have similar rights. Mendr does not sell personal data.
Last updated 10 October 2026. This page describes the system as built. If a claim here is ever shown to be wrong, it is corrected here and in TRUST.md in the same release. Questions or concerns: open a private report per the security page.