Built with security by default

Read-only GitHub access

BlueFairy connects to your repositories via a GitHub App with read-only permissions — enforced at the API level by GitHub itself. We can read the code, commit history and pull requests of the repositories you select. We cannot write code, create branches, delete repositories, or make any modification to your codebase. Write access is structurally impossible, not just a policy.

GitHub App permissions

Write access is structurally impossible

Your code doesn't train AI models

Repository context is sent to Google's Gemini API on a paid tier, where Google's terms explicitly prohibit using API data to train models. Google does not use it to improve its products. BlueFairy stores excerpts of code changes alongside the updates they relate to, so your team can ask follow-up questions, and never keeps a full copy of your repositories. Everything is deleted within 30 days of account closure.

Auth handled by GitHub, not BlueFairy

BlueFairy never stores or handles passwords. Authentication is delegated entirely to GitHub's OAuth system and managed by Supabase. We request only the minimum scope — read:user — granting identity information only. Session tokens are issued by Supabase and transmitted exclusively over HTTPS.

Auth flow

Encrypted storage, GDPR-compliant

All data is encrypted at rest using AES-256 via Supabase and in transit via TLS across all services. BlueFairy operates as a GDPR-compliant data processor under a published Data Processing Agreement. Your data is deleted within 30 days of account closure — we do not archive it. Backups and logs expire on our providers' standard schedules.