OHCAYGO / MERGE PROOF

Privacy Policy

Effective September 16, 2026

OHCAYGO operates Merge Proof, a service that binds available GitHub evidence to exact pull-request and merge states. Provider facts remain GitHub-trusted. This policy describes the information processed by our website and hosted service. Contact support@ohcaygo.com, or ryan@ohcaygo.com if support is unreachable.

Information we process and why

• GitHub identity and access: account identifiers, login names, App installations, repository access and authentication/session information needed to connect your account, check authorization and operate the service.
• Repository and pull-request evidence: repository/PR identifiers, file paths, commit SHAs, GitHub actor identifiers, check conclusions and available execution records, approvals, and branch protection/rules metadata needed to produce and refresh receipts. Repository metadata can be sensitive; this is customer data.
• Billing: if you subscribe, Stripe processes checkout and payment details. We process customer, subscription, invoice/payment status and observed active-developer information to administer your subscription. Card entry takes place on Stripe-hosted checkout.
• Service operation and support: request and security information, product events and information you send when asking for help. We use these to run, protect and troubleshoot the service, respond to requests and understand the connection-to-proof journey.

GitHub permissions, source access and retained Git objects

Contents read is real source access. The hosted service reads workflow text to inspect action references, and GitHub compare responses may carry diff patch text through server memory. Deterministic reconstruction creates a private partial bare mirror for the repository, fetches exact Git commit/tree objects for base, head, candidate and queue states, and retains Git objects and receipt refs for reconstruction and replay. Git may materialize reachable blobs when needed. This is source access and persistence, not metadata-only processing. Customer code is not executed.

Incidental API patch bodies and decoded workflow text are not persisted in receipts. Receipts retain normalized evidence, paths, workflow blob identities, hashes, checks, rules, reviews, actors and merge/landing facts. The mirror's retained Git objects are separate from that normalized receipt evidence.

The hosted proof product does not send source contents to an LLM or AI provider. No AI model decides the verdict.

The standard GitHub App reads Actions, Administration, Commit statuses, Contents, Merge queues, Metadata and Pull requests; Checks read/write lets it publish or update its own Check Runs. Organization members read verifies billing-owner authority. The standard App has no Contents write authority and cannot push commits, change files or workflows, merge or close PRs, post PR comments, or edit repository settings, branch protection or rulesets.

The optional Enhanced Policy Proof companion is separately authorized. Its repository Administration write grant is broader than the standard App's read-only Administration grant; the isolated broker constrains product operations to policy reads. It is not part of the standard connection.

The free local CLI and GitHub Action operate in the environment where you run them. You control the repositories and generated reports in that environment; GitHub also processes data when you use its Actions service.

Private receipts, access and retention

Private hosted receipts require current authorized repository and installation access, rechecked for each hosted request. Access follows repository authority, not only billing ownership. Uninstalling or revoking access stops new collection and hosted access fails closed. Uninstalling is not a deletion request and does not make retained evidence public.

Historical receipt and landing archives are append-only. Exact Git objects are retained by receipt refs in the private mirror. Active receipt eviction does not delete the historical archive. Uninstall or access revocation does not automatically erase receipts, archived artifacts, merge/landing observations, retained mirror objects and refs, account and billing records, event/operator history or operational backups.

The current implementation has capacity limits and backups, but no customer-selectable deletion deadline or automatic uninstall purge. Receipt access and availability are separate from historical retention; we do not promise permanent availability or a fixed retention period for every record. Information may also need to be retained to administer billing, meet applicable legal obligations, resolve disputes or protect the service. Contact us about a deletion request; any authorized removal must account for archives, mirror objects and backups separately.

Providers that help run Merge Proof

We use GitHub for account authorization and repository evidence, Stripe for subscriptions and payments, Cloudflare Pages and Cloudflare services for the public site and network delivery, and DigitalOcean for the hosted backend. These providers process information needed to deliver their services under their own policies and our service arrangements.

Cookies and analytics

Hosted sign-in uses necessary session cookies. We record limited first-party product events and a coarse acquisition channel such as X, other or direct; the landing-page attribution code does not retain advertising click IDs or arbitrary query text.

The public site includes Cloudflare Web Analytics for traffic and performance measurement. No X advertising pixel or similar advertising pixel is installed in the current site. GitHub, Stripe and our hosting providers may use cookies or similar technologies on their own services for authentication, security and service operation.

Your requests and questions

Email support@ohcaygo.com to ask about your information or request access, correction or deletion. Use ryan@ohcaygo.com if support is unreachable. Tell us which account or repository your request concerns; do not send passwords, access tokens or private keys. We may need to verify your identity and authority before acting. Any required retention or limits affecting your request will be explained in our response.

We will update this page when these practices change and identify the effective date above.