Privacy Policy
Last updated: August 5, 2026
Drydock ("Drydock," "we," "us," or "our") is operated by Anatolii Trubitsyn, a private individual resident in Almaty, Kazakhstan ("we," the "Operator"). No legal entity has been registered for Drydock: the person named here is the data controller, personally.
This Privacy Policy explains what data Drydock collects when you use our website, API, Telegram bot, and GitHub App (together, the "Service"), why we collect it, who we share it with, and what control you have over it. It is written to match exactly what the Service technically does today — not aspirational promises.
If you have questions or want to exercise any right described below, contact us at support@drydock.co.
1. The short version
- There is no signup and no password. You can run a free audit without giving us anything about yourself. If you buy a Fix Pack we ask for your name and email address, because payment is a manual bank transfer and those are what let a human match your money to your order — see Section 2.
- We do not store your source code. When you run an audit, your code is processed in memory to produce a list of findings (issue descriptions, file paths, line numbers). The code itself is not written to our database, and for zip uploads, it is never written to disk at all.
- Parts of your code are sent to a third-party AI model for analysis. This is the core of what Drydock does, and we want to be explicit about it — see Section 3.
- We do not currently have a self-service "delete my data" button. Email us and we will act on your request manually (see Section 7).
2. What we collect
2.1 Information you provide directly
| Data | When | Why |
|---|---|---|
| A public GitHub repository URL, or a zip file you upload | When you request an audit | To read your code and run the audit |
| Your name and email address | When you buy a Fix Pack | Payment is a manual bank transfer that arrives with nothing on it but the sender's name, so these are how a person matches your money to your order, and how we reach you if something goes wrong |
| An order reference and the amount quoted | When you buy | To identify your order and confirm the transfer |
| Your Telegram user ID and chat ID | Only if you contact our Telegram bot | To deliver or recover a key by Telegram message (/mykey, /link) |
We do not collect your physical address, your date of birth, or a password. We never receive, see, or store your card number — you transfer from your own bank, and all that reaches us is the name your bank puts on the payment.
2.2 Information generated by using the Service
| Data | Description |
|---|---|
| Audit findings | For each audit: a score, and a list of findings — each with a file path, line number, a short title, an explanation, and (for secret findings) a masked preview (e.g. AKIA****(20 chars)) rather than the actual secret value. |
| Repository / pull request URLs | If you audit a public GitHub URL, or Drydock opens a Fix Pack pull request, we store that URL. This indirectly reveals the GitHub account that owns the repository. |
| API key | A random key is generated for your account; we store a salted hash of it, not the key itself, so we cannot recover a lost key for you (only you hold the plaintext). |
2.3 What we automatically log
- Your IP address is used momentarily, in memory, to enforce rate limits (so one visitor can't overload the Service). It is not written to our database.
- We do not use cookies. Your browser locally stores a theme preference (light/dark) and, for the duration of your browser tab, your API key and the current audit's result — this data lives only in your browser and is never sent to us as "analytics."
3. Your code and third-party AI analysis — the most important part
When you request an audit, Drydock does not send your entire repository to anyone. Here is exactly what happens:
- Your code is read into memory (from the zip you uploaded, or downloaded from the public GitHub URL you gave us). It is never written to disk during this step.
- We filter out irrelevant files (e.g.
node_modules/,.git/, build output) and keep only source-code file types relevant to the audit's rubric (currently authentication and general security). - From what remains, only files whose path or content match security-relevant keywords are selected for deeper analysis.
- Each selected file is truncated to a maximum size, and the total amount of code sent for one audit is capped, before being sent to a large language model for analysis.
- The model's response — the findings — is what we store. The literal code snippets used to double-check a finding (an internal verification step) are discarded and never saved to our database.
Who receives these code fragments: Drydock uses AITunnel (an LLM API proxy) as its primary provider, with a direct Anthropic API connection as a fallback. Both process the code fragments solely to generate the audit response; we do not control or have visibility into their own data-retention policies beyond what they publish themselves, and we encourage you to review them if you have specific requirements.
Practical implication: if your code contains a live secret (an API key, password, etc.), that secret's value is included in the fragment sent to the AI model for detection purposes, but is never stored by Drydock afterward — only a masked preview is kept. If you find a real secret in an audit, treat it as compromised and rotate it, independent of anything Drydock does or doesn't store.
If this data flow is not acceptable for your use case (e.g. a private, highly sensitive codebase), do not use Drydock to audit that code.
4. Who else we share data with
| Recipient | What they receive | Why |
|---|---|---|
| Supabase (database host) | All data described in Section 2 | Stores our application database |
| AITunnel / Anthropic | Code fragments described in Section 3 | Runs the AI analysis |
| GitHub | A repository URL (to fetch public code); if you install our GitHub App, installation tokens are used to open a Fix Pack pull request on your behalf | Reading your code; opening a fix PR |
| Telegram | Your Telegram identifiers, and messages we send you | Notification and key delivery, if you use the bot |
| The operator's bank | Nothing from us — your own bank sends your name with your transfer, and that is how it reaches us | Receiving payment |
| Timeweb (server host, Russia) and Vercel (frontend host) | Whatever passes through our servers in the normal course of operating the Service | Hosting |
We do not sell your data, and we do not share it with anyone for advertising purposes.
5. How long we keep data
Audit results, payment records, and subscription records are currently kept indefinitely — we do not yet have an automatic deletion schedule. Temporary working directories used to build a Fix Pack, and preview environments, are deleted automatically (previews expire and are cleaned up on a schedule; typically within hours).
We are working toward formal retention limits; until then, you can request deletion manually (Section 7).
6. Your rights
Depending on where you're located, you may have rights under laws like the GDPR (EU/EEA), UK GDPR, or similar regimes, including the right to access, correct, or delete your data, and to object to or restrict certain processing. What we hold about you is tied to the name and email you gave at checkout, your order reference, your API key, your Telegram identifiers, or a repository URL — tell us whichever you have when you contact us, so we can locate the right records.
Right to erasure: we do not currently offer a self-service deletion button. If you email us at support@drydock.co and identify your API key (or the Telegram/payment identifier tied to your data), we will delete the associated records within 30 days, except where we are required to keep payment records for tax or legal reasons.
Right to access: email us and we will tell you, in writing, what records we hold tied to the identifier you provide.
7. Contact
For any question about this policy, or to exercise the rights above, email support@drydock.co.
8. Children
The Service is not directed to children, and we do not knowingly collect data from anyone who has not reached the age of consent required to enter into a payment transaction in their jurisdiction.
9. Changes to this policy
If we change how we collect or use data, we will update this page and change the "Last updated" date above. Material changes will be highlighted on the site.