Privacy Policy

Last updated: 18 October 2026

1. Who’s responsible

Epherem is run by the operator named in our Terms of Service (section 17, “Who provides Epherem”). The operator is responsible for your personal data under Singapore’s Personal Data Protection Act 2012 (the PDPA), and is the person to contact about it, at support@epherem.com. In this policy, “we” and “us” mean the operator.

2. What we collect, and why

Your account

• Your email address, and your name if your Google account gives one. Our sign-in provider, Supabase, keeps your sign-in. If you sign in with Google, Supabase also receives your Google profile: your name, email address, Google account ID and a link to your Google picture. Your picture is shown from Google; we don’t copy it. We use these to sign you in and to write to you about your account.
• The name you choose to be called (optional, up to 80 characters). It’s shown in the app and to the operator.
• Your acceptance of the Terms and this policy: which versions you accepted, and when. Not your IP address or your browser.
• Your choice about product emails: whether they’re on, when you last changed it, where (sign-up, Settings, or a request to us), and the wording you were shown, with a history of changes.

How you heard of Epherem

When you finish signing up, we keep your answer to “How did you first hear about Epherem?”, with any detail you type (up to 400 characters). With it, we keep where your visit came from: the first page you landed on, the website that sent you (without anything after a “?” in its address), and any campaign tags in the link (utm tags). Your browser holds these until you finish signing up, then sends them once. When you create an app, you can also tell us what you built it with. We use these answers to learn which channels bring people to Epherem and which tools they build with.

What you do in the app

• Product events. We record these events, each with your account, the time, and the report or app it was about: report_viewed, findings_expanded, finding_opened, export_clicked (with the format you chose), fix_prompt_copied, mcp_setup_viewed (opening the AI agent page’s setup), github_connect_started (pressing a button that connects GitHub) and github_connect_completed. And, before a scan starts: scan_screen_viewed (seeing the screen that starts a scan), zip_refused_type, zip_refused_size and zip_refused_files (a file the page refused before uploading: not a ZIP, too large, or with too many files), zip_upload_failed (an upload that didn’t reach us) and github_connect_refused_org (connecting a GitHub organisation, which Epherem doesn’t support yet). And, when you connect GitHub: github_callback_returned (GitHub sending you back to Epherem) and github_connect_refused (a connection Epherem turned down, with which of its reasons it was). They hold no IP address and nothing you typed.
• Scan records. For each scan you start, we record how it ended (finished, refused or failed, and why), whether it came from a ZIP or GitHub, how long it took, how many files it read, the upload’s size, the frameworks it detected, and how many findings of each kind it found. Scan records hold no code and no file, app or repository names.

We use product events and scan records to understand how Epherem is used and to improve it (section 8).

IP addresses

Our servers use your IP address to limit how many requests one address can make. They keep it only in the server’s memory, and don’t store it anywhere. Our providers may record IP addresses in their own logs, such as the sign-in records Supabase keeps and the request logs Google Cloud keeps.

Feedback

When you send feedback in the app, we keep your email address, the topic, your message, and any screenshot you attach (up to 20 screenshots per account). Two boxes, both ticked to start with, decide what else is sent:

• “The scan you picked, and its report”: which scan, report and app you mean, so the operator can open that report. Unticked, none of these is sent.
• “Debug info”: the page’s address (without anything after a “?”), the app’s version, your browser and operating system and its user-agent string, your window and screen size, language, local time and time zone, whether you were online, up to 5 recent errors on the page with their technical details, and the last request to Epherem that failed (its address, status and error message). Unticked, none of these is sent.

GitHub

If you connect GitHub, we keep your GitHub App installation’s number, your GitHub login and user number, and the names of the repositories the App could read when you connected. For an app made from a repository, we keep the repository’s name and number, and each report records the commit it read. We never keep your GitHub sign-in token.

Keys for the AI agent page

For each key you create on the AI agent page, we keep a fingerprint (a SHA-256 hash), its first 12 characters, the name you give it, and when it was created, last used and deleted. We never keep the whole key.

In your browser

Epherem’s own code sets no cookies. Your browser’s storage keeps your sign-in (by Supabase’s code), where your visit came from until you finish signing up, a copy of your app list and scan summaries for speed, and a few choices such as how your apps are shown. Signing out clears what Epherem stored about your account in this browser.

When you ask for a sign-in code by email, Cloudflare Turnstile checks that a person, not a script, is asking. It runs in your browser, and Cloudflare handles what it collects under Cloudflare’s own privacy policy.

3. Your code

A ZIP you upload goes from your browser to our storage at Google Cloud. Our server copies it, unpacks it into a temporary folder, and scans it. When the scan ends, whether it finished or failed, and when a scan is refused, the server deletes the upload and the unpacked copy. If an upload is ever left behind, for example because a server stopped in the middle of a scan or a request failed, a storage rule deletes it once it’s a day old. That rule runs about once a day, so this can take up to two days. Temporary folders left on a server are removed by a clean-up pass after 15 minutes.

A GitHub repository you scan is downloaded by our server straight from GitHub into a temporary folder, scanned, and deleted when the scan ends. It’s never put in our storage.

We don’t keep a copy of your project. What we keep is the report (section 4).

To check your packages, our server sends the name, version and ecosystem (for example npm) of each package your project uses to OSV.dev, a public database of security advisories, and asks for the advisories that match. Your code isn’t sent.

No AI reads your code. The scan uses fixed rules, not an AI model. We never send your code, report excerpts or files to an AI service. (If you connect your own AI tool on the AI agent page, it reads your reports when you ask it to; see section 9.)

4. Your reports

A report holds each finding with its file path, line number, a short excerpt of your code, an explanation, a suggested fix and a prompt for your AI tool. It also holds the advisories that match your packages, what the scan read and couldn’t check (including the names of the files it read), and, for a GitHub scan, the repository and commit.

Before a report is saved, and again every time it’s read, Epherem masks values that look like keys, tokens and passwords. For a key that a rule finds, the report keeps only its first six and last three characters, so you can tell which key it is. Masking works by matching patterns, so it can miss a secret written in an unusual way.

We keep a report until you delete it, its app, or your account. Reports don’t expire. A copy you export is yours: deleting the report in Epherem doesn’t delete it.

5. Chat and Telegram

Messages you write in the chat are stored in our database (Supabase), and a copy goes to the operator’s phone through Telegram, a messaging app. That copy shows your name, your email address, what your apps are built with, how many scans you’ve run, and your message. The operator’s replies come back to the chat.

Telegram also receives these notes for the operator:

• when you run your first scan: your name and email address, what the app is built with, the app’s name, and how many findings of each kind it found. Never code;
• when you send feedback: your name and email address, the topic, and the first 500 characters of your message;
• when you delete your account: your name and email address, so the operator can delete your messages there.

Telegram keeps these copies until the operator deletes them. We delete them by hand when you delete your account, and sooner if you ask. We may stop an account from using the chat if it’s misused. We also export chats from time to time to read them together and improve Epherem (section 9).

6. Emails we send

To you, about your account:

• Sign-in codes, sent by Supabase when you sign in with an email code.
• Unread messages: if a reply from the operator stays unread for 30 minutes, we email you about it, at most once a day. It holds the reply (up to 1,000 characters). This email is sent by Resend.
• Changes to the Terms: we email every account about real changes (Terms, section 14).

To you, about Epherem, only if you ask for them: occasional updates, beta invitations, product launches and requests for feedback. They’re off unless you tick the box when you sign up, or turn on Product emails in Settings. You can turn them off the same way at any time, or reply “unsubscribe” to any of them. We stop within 10 business days, and usually the same day.

To the operator:

• Your feedback, in full, to our support inbox, with your email address (so we can reply), what you chose to send with it, and a link to any screenshot that works for 7 days.
• A daily summary. It lists new accounts and what happened the day before: names and email addresses, how people heard of Epherem and the names they chose, how they signed in, app names and what they’re built with, finding counts, the first 140 characters of each message waiting for a reply, and the first 200 characters of each piece of feedback.

7. Looking at accounts

The operator can open an account on Epherem’s admin page and see its details (name, email address, how and when it signs in, when it accepted the Terms, its choice about product emails, its GitHub login, its onboarding answers, its scan counts, and whether it’s blocked from the chat), its apps and scans, its chat and feedback, and any of its reports as you see it.

We do this:

• to answer your messages;
• on our own initiative, to support you and to improve Epherem, for example after your first scan; and
• to investigate bugs and abuse.

Each time we open your account or one of your reports on that page, the view is logged: in your account’s own record, and in a list of recent views the operator sees (the last 200, with times and IDs only). Your record is deleted with your account, and your entries are removed from that list.

Other admin tools show figures across all accounts, how people heard of Epherem, and an export of all chats (section 5). Those aren’t logged against each account.

8. Analytics and anonymous statistics

We use your product events, scan records and onboarding answers to understand how Epherem is used and to make it better. Under the PDPA, this is a business improvement purpose, and this policy is our notice of it. There is no separate switch to turn these records off; if you don’t want them kept, you can delete your account.

Cloudflare, which hosts our website, may count visits to our pages with its Web Analytics.

We may publish anonymous statistics, such as “4 in 10 apps built with Lovable had …”. They are always combined across many apps. They never name a person, an app or a repository, and they never quote anyone’s code.

9. AI tools

The operator uses ChatGPT (from OpenAI) and Claude (from Anthropic) to analyse numbers and to help with support conversations, such as exported chats. Names and email addresses are removed first, and training on the data is turned off. These tools never receive your code, report excerpts or files.

The scan itself uses no AI.

If you connect your own AI tool on the AI agent page, it reads your reports, including the code excerpts in them, under your own agreement with the company that makes it.

10. Who receives data

We don’t sell personal data. We may disclose it when the law requires us to.

11. Where it’s stored

Our servers and storage are at Google Cloud in Singapore (the asia-southeast1 region). Our database is at Supabase. The other companies in section 10 handle data where they operate, which can be outside Singapore.

12. How long we keep it

13. Deleting your account

Settings → Delete account deletes everything below. You can’t delete your account while a scan is running. The steps run in this order, automatically:

1. your GitHub connection. Epherem also uninstalls its App from your GitHub account, unless another Epherem account uses the same installation;
2. your keys for the AI agent page, at the same time as steps 3 to 8;
3. your uploads, reports, apps, scan progress, daily counters and GitHub records, and our record of views of your account;
4. your scan job records, and your entries in our list of recent views;
5. your product events, scan records, onboarding answers, Terms acceptance, product-email choice and its history, feedback and “built with” answers;
6. your place on the waitlist;
7. your feedback screenshots;
8. your chat messages. Just before this, a note goes to the operator’s Telegram to delete your messages there;
9. last, your sign-in.

If any step fails, we keep your sign-in so you can try again, and the operator is told.

By hand, the operator deletes the copies of your messages in Telegram, and, if you ask, your feedback emails in our support inbox.

Deleting your account doesn’t delete reports you exported, what your own AI tool has read, daily counts that hold no names, or the logs and records our providers keep for their own periods (section 12).

14. Your rights

You can ask us for a copy of the personal data we hold about you, ask us to correct it, ask us to delete it, and withdraw your consent to how we use it. Write to support@epherem.com. You can also change your name in Settings, and delete reports, apps and your whole account yourself.

If you withdraw consent, we may no longer be able to provide Epherem to you, and we’ll tell you what that means before we act on it.

If you’re unhappy with how we handle your data, please write to us first. You can also complain to Singapore’s Personal Data Protection Commission.

15. Age

Epherem is for people aged 18 or older (Terms, section 1). We don’t knowingly collect personal data from anyone younger. If we learn that we have, we’ll delete it.

16. Changes to this policy

When we make a real change to this policy, we’ll email every account, and the change takes effect 14 days later. A fix to the wording that doesn’t change what the policy means only changes the “Last updated” date. A change needed urgently for a legal or security reason can take effect immediately.