# Your data in Hephaestus

Hephaestus reads the work that your project connects, to give you practice feedback and answer your questions. It can process your work even if you have never signed in. This page lists what it reads, who can see it, and how long it stays.

**Privacy** in the app footer opens your instance’s privacy notice. The notice names the responsible organization, the privacy contact, the legal bases, the providers, and where data is stored. If the notice or the contact is missing, ask the organization that runs your instance.

## Who can see what

| Your data                                     | Other members                             | Workspace admins                                                                               | Instance admins                        | Anyone                                               |
| --------------------------------------------- | ----------------------------------------- | ---------------------------------------------------------------------------------------------- | -------------------------------------- | ---------------------------------------------------- |
| Practice profile and its feedback             | No                                        | That feedback exists and its delivery state, not its text                                      | Read-only view, with a recorded reason | No                                                   |
| Practice observations                         | Only inside unnamed counts                | Yes                                                                                            | Yes                                    | No                                                   |
| Your answers to feedback                      | No                                        | Your current answer and the reason for a current **Disagree**. Not your rating or other notes. | Read-only view, with a recorded reason | No                                                   |
| Your conversation with Hephaestus             | No                                        | No                                                                                             | Read-only view, with a recorded reason | No                                                   |
| Activity: your work in workspace repositories | Yes                                       | Yes                                                                                            | Yes                                    | Only if you choose to show on a public activity page |
| Feedback posted on GitHub, GitLab, or Slack   | Everyone who can see that work or channel | The same                                                                                       | The same                               | The same                                             |

* **Other members** see Activity for every workspace repository. Hephaestus does not check whether each member can open the repository on GitHub or GitLab.
* **[Practices across the workspace](/next/user/practices-across-the-workspace.md)** shows your observations to other members only inside counts that name nobody. It shows every count, also a count of one, so members can sometimes tell how your work went. [Small counts](/next/user/practices-across-the-workspace.md#small-counts) lists when.
* **Instance admins** read your private data only through **View as user**, also before your first sign-in. Each view records a reason. The view cannot act for you. Workspace admins do not have this access.
* **Instance admins who are not members** can open any workspace as a workspace admin, never as its owner. Hephaestus records that they did. Instance admins also read your product feedback reports.
* **Your instance operator** can reach stored data to run the instance and to answer privacy requests.
* **A public activity page** shows only work in public repositories, and only for people who chose to show. [Public activity page](/next/user/public-activity.md) explains the choice.

## What Hephaestus reads

Workspace admins choose the connected sources:

* **GitHub and GitLab:** contributor profiles, repository and team membership, and commit metadata. Also issues, pull requests, merge requests, reviews, comments, and discussions. Practice reviews can also read code changes, repository snapshots, and Git history.
* **Slack:** identities, privacy choices, your direct conversations with Hephaestus, and new messages in monitored channels. A workspace admin chooses the monitored channels, and monitoring starts only after Hephaestus posts a visible announcement. Each person in a monitored thread gets a separate review of their own messages.
* **Outline:** selected collections and documents, their content, and author information.
* **Chrome extension:** the address of each supported work page that you open on an allowed site. [Chrome extension privacy](/next/user/browser-extension-privacy.md) lists everything it reads and sends.

A practice review can read every workspace area and repository that it is allowed to use. This includes Slack threads and the earlier observations and feedback about the same person. There is no fixed limit on the number of records or on how far back the review reads.

From these sources, Hephaestus records:

* **Practice observations and practice feedback**, also observations that never become comments. An observation can store the problems it found and an example from your work.
* **Activity:** your pull requests, reviews, issues, and comments in workspace repositories, and your open work, such as review requests.
* **Your account:** sign-in details, connected accounts, memberships, preferences, your conversation, and your reactions to feedback.
* **Product feedback reports**, with the page route and the Hephaestus release. [Product feedback](/next/user/product-feedback.md) explains who receives a report and when it becomes public.
* **Security and cost records:** sign-in events with IP address and browser, changes to settings, review diagnostics, and AI usage.

The app uses only essential cookies and browser storage, for sign-in, security, and preferences. The server keeps diagnostic logs on your instance’s hosts.

Your instance can turn on browser reports of page load times and of faults. They carry no identity, page address, or error message.

Your browser loads each avatar from GitHub or GitLab, so that host receives your IP address.

Do not put secrets or personal details that the work does not need into messages to Hephaestus or into source content.

## Signing in and choosing research participation

The sign-in screen links to your instance’s privacy notice and imprint. After sign-in, one page shows up to two separate decisions.

**Terms and privacy** says what Hephaestus reads, that an AI model writes feedback that can be wrong, and where to find the privacy notice. To continue, select **I accept the terms of use**. The terms ask you to use only work that you are entitled to see. They also ask you to treat feedback as guidance, not as an assessment to share. Accepting the terms is not research consent.

**Allow research use of your data?** appears only if your instance names a research organization. Research is optional, and Hephaestus works the same with either answer. Choose **Yes, allow research use** or **No, keep my data out of research**. Neither answer starts selected, and **What this means** gives the details.

If you allow it, the named organization may use your data to study how developers work and learn. It also studies how AI systems can review and support that work. This includes benchmarks and evaluation datasets for such AI systems. Your data means your connected work, Hephaestus’s observations and feedback about it, your responses, and how you use Hephaestus, including your conversation. Research use never includes browsing data from the Chrome extension.

The research team replaces your name with a code before analysis. Only the team and its AI model providers work with data that could identify you. Others get only anonymized datasets.

**Save and continue** records your decisions with the version of the text that you saw. Hephaestus asks again if new text allows more or different research use, or if your instance names a different research organization.

### Research participation

To change your answer, use [Research participation in User settings](/next/user/user-settings.md#research-participation). When you withdraw:

* New research use of your data stops.
* The team removes your data from datasets that are not anonymized.
* Research done before you withdrew stays lawful.
* Anonymized data in a published result cannot be traced back to you, so nobody can remove it.

Withdrawal does not erase other data. For data in a published dataset, contact your instance’s privacy contact.

## Your AI choice

Your AI choice decides which AI models may receive your data. [Your AI choice in User settings](/next/user/user-settings.md#your-ai-choice) explains the three answers and how to change them.

When an AI feature runs, Hephaestus sends the relevant code, discussion, documents, conversation history, and observation evidence to the AI provider. A self-hosted instance can send these requests to an outside provider. A provider may process, keep, or review the data under its agreement with your organization. Your AI choice does not set a retention period or a training policy. Ask your workspace admin which provider your workspace uses and on what terms.

## Your choices and right to object

These controls change what Hephaestus does with your data:

* [Your AI choice](/next/user/user-settings.md#your-ai-choice) limits or stops AI processing about you.
* [Comments on your work](/next/user/user-settings.md#practice-feedback) stops new feedback comments on your work.
* [Slack](/next/user/user-settings.md#slack) stops the use of your channel messages and deletes the ones already collected.
* [Show me on public activity pages](/next/user/public-activity.md#show-or-hide-yourself) adds or removes you from public pages.
* [Email notifications](/next/user/user-settings.md#email-notifications) chooses your optional emails.

To disagree with feedback, [respond to it on your Practice profile](/next/user/practice-profile.md#respond-to-feedback). A disagreement is not erasure.

Turning off comments, leaving a workspace, or never signing in does not stop processing. To object to processing, or to ask for access, correction, restriction, or erasure, contact your instance’s privacy contact. You can do this without an account. Your instance’s notice also explains how to complain to a supervisory authority.

## Your conversation

Hephaestus keeps one conversation with you in each workspace. It holds your messages, its answers, the context that it read to answer you, and the page that you sent with a message.

* To erase a message in the app, select **Delete message** under it.
* To erase a message that you wrote in Slack, delete it in Slack.

Deleting a message erases its text in Hephaestus, also from Hephaestus’s memory of the conversation. If a workspace admin disconnects Slack, Hephaestus erases the messages written in Slack in that workspace.

## Get a copy of your data

[Export your data in User settings](/next/user/user-settings.md#export-your-data) gives you your account data, your conversations, and the feedback delivered to you. The privacy contact handles requests for the records that the export leaves out:

* Tool results in your conversations, observations, withdrawn feedback, and feedback never delivered.
* Activity records and copies of source content.
* Product feedback reports.
* Other kept copies.

An instance admin can then give you these records as one JSON file, without credentials or other people’s profiles.

## Delete your account or request wider erasure

[Delete account in User settings](/next/user/user-settings.md#delete-your-account) erases your account and the data of the identities connected to it. For anything else, such as another identity or posted feedback, send a request to your instance’s privacy contact. You can do this with or without an account.

1. Send your workspace, the provider, and your user ID there. For Slack, add the Slack workspace ID.
2. Add links to the affected work and to any posted feedback that you want removed. Without your user ID, add a link to your profile.
3. Ask for the scope, the status, and any legal exceptions.

Do not send passwords, tokens, or identity documents. The operator checks which records belong to you, because names, logins, and email addresses do not prove it. The operator confirms the scope before erasure and normally answers within one month. An extension of up to two more months needs notice within the first month.

After deletion or erasure, Hephaestus keeps:

* An account record with the contact details cleared.
* The minimal identity keys that stop it from processing those identities again.
* Your login, if it names a workspace on your own GitHub or GitLab account. Nobody else can then take that name.

Erasure in Hephaestus does not delete your original work on GitHub, GitLab, Slack, or Outline. Removal of feedback that Hephaestus posted there is a separate operator step, with no guarantee of success.

## How long data stays

What Hephaestus says about you stays for 400 days, unless your operator sets another period:

* **Feedback:** 400 days after delivery. Feedback that was never delivered: 400 days after Hephaestus wrote it.
* **Observations:** 400 days after Hephaestus recorded them. An observation stays while kept feedback cites it or a running review reads it.
* **Your conversation:** each message and answer, 400 days after it was written, or up to two weeks earlier.

Other data follows its source:

* **GitHub and GitLab work:** while a workspace monitors the repository.
* **Slack channel threads:** a rolling period from the latest message. An active thread can hold older messages.
* **Outline documents:** while their collection and connection stay active.
* **Memberships:** until account deletion, workspace removal, or erasure.
* **Product feedback reports:** no expiry by age. Public copies on GitHub can remain.

Security records, review diagnostics, logs, and backups have their own periods. Some copies, such as backups, cannot be erased one person at a time. Ask your instance admin, or read [Data retention](/next/admin/data-retention.md) for each period and what an operator can change. Your instance’s privacy notice states the periods that your deployment applies.