1. Scope
This Policy applies to the AI Overflow website, command-line interface, profiles, reports, rankings, and community features.
In this Policy, “AI Overflow,” “we,” “us,” and “our” refer to the operator of the Service.
“Service” means the AI Overflow website, software, features, and related services.
2. Information we collect
2.1 Account data
We collect your name, username, email address, profile roles, profile skills, policy acceptance, and account connection data.
We store a password hash and related security data. We do not store your plain-text password.
2.2 CLI data
When you run npx ai-overflow, the CLI sends a sanitized usage report from supported AI coding tools.
The report can contain product names, models, activity groups, tool names, MCP server names, and shell-command names.
It can contain skill names, subagent names, daily totals, calls, turns, token totals, cost, and report timestamps.
AI Overflow sends aggregate usage signals to OpenRouter and its selected model provider to calculate scores and generate guidance. We request providers that do not retain this request data.
For AI solutions, we send the conversation you submit to OpenRouter and its selected provider. Do not submit secrets.
After the first successful upload, automatic synchronization starts by default on supported systems.
2.3 GitHub data
If you connect GitHub, we collect your public GitHub identity, avatar, profile link, and public activity.
We store a 90-day aggregate of public commits, merged pull requests, active days, sample dates, and the fetch time.
We refresh this aggregate at most once a day. A GitHub score bonus is limited to five points and cannot lower your score.
We do not access private repositories.
The Service receives a temporary access token when it exchanges your OAuth code.
The Service requests no extra scope and does not store the token.
2.4 Community and technical data
We collect questions, answers, comments, likes, follows, and other content that you submit to the Service.
Our servers receive request data needed to operate and secure the Service. This data can include an IP address and user-agent information.
3. How we use information
We use information to operate accounts, profiles, reports, rankings, community features, and GitHub connections.
We also use information to secure the Service, prevent abuse, diagnose errors, enforce our Terms, and obey legal duties.
4. How we disclose information
We disclose public profile data to people who access the applicable profile, report, ranking, or community page.
We disclose information to hosting, database, authentication, and infrastructure providers that help us operate the Service.
We can disclose information when law requires it, or when disclosure protects users, the public, or the Service.
We can transfer information during a merger, financing, acquisition, reorganization, or sale of assets.
We do not sell personal information or use it for targeted advertising.
5. Public profile data
Public profiles can show identity data, roles, skills, community activity, usage totals, scores, GitHub activity, and sanitized report details.
Sanitized reports can show models, activity groups, tools, MCP servers, shell commands, skills, subagents, daily totals, costs, and guidance.
The public report never contains passwords, email addresses, prompts, source code, file paths, project paths, session identifiers, cookies, CLI tokens, OAuth state, or provider tokens.
The public report also excludes database identifiers and raw authentication data.
6. Retention and controls
We retain account and report data until you request deletion, unless a longer period is necessary for legal or security reasons.
We keep GitHub activity as a rolling 90-day aggregate.
You can stop automatic CLI synchronization with npx ai-overflow --no-auto-sync. You can still upload reports manually.
You can disconnect GitHub from your profile. During the private beta, ask the person who gave you access to submit an account-deletion request to the operator.
7. Security
We use reasonable administrative and technical safeguards to protect information.
No storage or transmission method is completely secure. We cannot guarantee absolute security.
8. Your rights and choices
Applicable law can give you rights to access, correct, erase, restrict, or obtain a copy of your personal information.
You can also object to some processing or withdraw consent. A withdrawal does not affect earlier lawful processing.
We can request information that reasonably proves your identity before we complete a request.
9. Children
The Service is not directed to children under 13. Do not use the Service if local law does not permit your use.
10. Changes to this Policy
We can update this Policy when the Service or applicable law changes.
We will change the effective date and provide additional notice when law requires it.
11. Contact
During the private beta, contact the person who gave you access. That person can send your privacy request or question to the operator.