# Your data in Hephaestus

Hephaestus reads connected project work to give you practice feedback and answer your questions about it. **Hephaestus can process your work even if you have never signed in.**

**Privacy** in the app footer gives your instance’s responsible organization, privacy contact, legal bases, providers, and data locations. This page explains how the product behaves and what you control. Your instance’s notice gives the legal and provider details for your deployment.

For a specific task:

* [Change your AI choice](#your-ai-choice).
* [Stop comments or control Slack messages](#your-choices-and-right-to-object).
* [Get a copy of your data](#get-a-copy-of-your-data).
* [Delete your account or request wider erasure](#delete-your-account-or-request-wider-erasure).

1. Open **Privacy** in the app footer.
2. If the notice or contact is missing, ask the organization that runs your instance.

## Signing in and choosing research participation

The sign-in screen links to your instance’s privacy notice and imprint. You can read both before you choose a provider. Setup then shows one page with up to two separate decisions. You see both before you make either.

The first, **Terms and privacy**, has three short points:

* **What it reads:** your work in the tools your project connects.
* **Feedback can be wrong:** an AI model writes it, so check it against the work first.
* **Your data:** where to find your instance’s privacy notice.

To accept the terms, select **I accept the terms of use**. The terms ask you to use only work you are entitled to see. They also ask you to treat feedback as guidance for the person it is for, not as an assessment to share. Accepting the terms is not research consent.

The second decision, **Allow research use of your data?**, appears only if your instance names a research organization. The screen shows that name. Research is optional, and Hephaestus works the same either way. Without a named organization, the terms alone complete setup.

If you allow it, the research organization may use your data for research. The research looks at how developers work and learn, and how AI systems can review and support that work. It includes building and running benchmarks and evaluation datasets for such AI systems.

Your data means:

* Your work in the tools your project connects.
* Hephaestus’s observations, problems and feedback about that work.
* Your responses to that feedback.
* How you use Hephaestus, including your conversations with Hephaestus.
* Your answers to research surveys.

The research team replaces your name with a code before analysis. Only the team and its AI model providers work with data that could identify you. Nobody else gets a dataset unless it is anonymized.

You can withdraw at any time, as easily as you said yes. Withdrawing stops future use. The team then removes your data from datasets that are not yet anonymized. It cannot remove anonymized data that is already in a published result.

Select **What this means** to read more. It opens seven short points:

* What data.
* Who uses it.
* How it is protected.
* Datasets and benchmarks.
* If you change your mind.
* Your choice has no cost.
* Your rights.

[Your AI choice](#your-ai-choice) applies to benchmark runs that use AI models.

Choose **Yes, allow research use** or **No, keep my data out of research**. Neither answer starts selected, and you must choose one.

**Save and continue** records your decisions against the version of the text you saw. When that text changes, setup asks again, and an earlier **Yes** does not carry over to the new text. When your instance names a different research organization, setup asks the research question again. You can change your research answer later. [Your choices and right to object](#your-choices-and-right-to-object) explains how.

## What Hephaestus reads

Workspace admins choose the connected sources and what runs in the workspace:

* **GitHub and GitLab:** contributor profiles, repository and team membership, and commit metadata. They also supply issues, pull requests or merge requests, reviews, comments, and discussions. Practice reviews can also read relevant code changes, repository snapshots, and reachable Git history.
* **Slack:** identities, privacy choices, direct conversations with Hephaestus, and new messages in monitored channels. Channel monitoring requires separate activation, a visible announcement, and participant privacy controls. A Slack connection alone does not activate it. Each person in a monitored thread gets a separate review. That review judges only that person’s own messages.
* **Outline:** selected collections and documents, their content, and author information.

Practice reviews can read all permitted workspace areas and repositories available to the review. This includes Slack threads and observation and feedback history scoped to a person. There is no fixed limit on the number of records or the history period for that context. Privacy choices, access boundaries, and erasure checks still apply.

Generated-path settings mark retained evidence but do not remove it. Refusal to review a bot’s work does not erase its source records. A connection alone does not authorize all uses of its content. These sources supply context for practice reviews and conversation answers.

Hephaestus records **practice observations and practice feedback**, including observations that never become comments. An observation can also store the problems it found, an example from your work, and open questions. [Activity](/user/activity.md) counts and lists your pull requests, reviews, issues, and comments in workspace repositories. It also lists your open work, such as review requests and assigned issues. Workspace activity can sort people by these counts.

Your sign-in details, connected accounts, memberships, preferences, conversations, and feedback reactions support your account and conversations. Product-feedback submissions support product improvement, as do survey invitations, answers, and declines. Submissions include the page path and browser identification you choose to attach, plus the Hephaestus release that received them. A **Research** survey is available only while you allow research use for the organization your instance names. Its answers are research data, collected under your research consent.

These records support security, troubleshooting, and spending controls:

* Authentication events, including IP address and browser information.
* History of changes to settings.
* Review diagnostics.
* AI usage accounting.

The app uses essential cookies and browser storage for sign-in, security, and preferences. It sends no error reports from your browser. The server keeps its own diagnostic logs on your instance's hosts. Your instance must disclose where those logs go, why, and for how long.

When a page shows an avatar from a source platform, your browser requests the image from its host. That host receives network metadata, such as your IP address and the image address. This also occurs on pages that do not need sign-in. The host’s retention is separate from Hephaestus.

1. Do not include secrets or unnecessary personal or sensitive information in messages to Hephaestus, source content, or feedback.

## Your AI choice

[Your AI choice](/user/workspace.md#your-ai-choice) sets which models may review practices about you and handle your questions in conversations. **In-house** allows models your organization says it operates. **Cloud** also allows models operated by providers your organization approved. A provider may process, keep, or review received data under its agreement with your organization. Your choice does not set a retention period or training policy.

**No AI** stops new practice reviews about you, new questions in conversations, and new feedback delivery. It does not stop source sync, stored work, access by authorized people, or requests already sent to a provider. Your work can still appear in shared repository context for reviews about other developers. Your choice does not remove that content or change their choices or model routes. Hephaestus checks observation and feedback history scoped to you separately against your AI choice.

You answer once, across all your workspaces on this deployment. **Cloud** allows In-house models too. **In-house** does not allow Cloud models. Hephaestus never changes your answer to allow more AI processing. New workspace models do not require another answer. This choice is separate from research participation and connected accounts.

1. To change your answer, open **Your AI choice** in a workspace sidebar or **User settings**.
2. Ask the workspace owner about the actual provider, location, retention, and training terms.

The owner declares who operates each model. Hephaestus uses the same AI choice in Slack. Its App Home explains when Ask Hephaestus is off for you, requires a choice, or has no eligible model. Channel-message controls stay available when Ask Hephaestus cannot answer. A failed Home refresh can leave an older status visible. Each new interaction still checks eligibility.

## AI processing and visibility

Active AI features send relevant code, discussion, documents, conversation history, and observation evidence to the workspace’s configured AI provider. **Self-hosting does not necessarily keep AI requests local.** Your instance’s privacy notice covers recipients, international transfers, retention, and training terms.

1. Ask your workspace admin which provider is configured.

Developers decide what to do with feedback: fix the work, ask why, or disagree. Merge decisions stay with your reviewers. Access differs by role and destination:

* Members can read [Activity](/user/activity.md) without individual source-platform permission checks. Normal member access keeps your Practice profile, its feedback, and conversations private. Other members see your observations only inside the counts of [Practices across the workspace](/user/practice-profile.md#practices-across-the-workspace), which never name anyone. The page shows every count, also a count of one, so other members can sometimes tell how your work went. [Small counts](/user/practice-profile.md#small-counts) lists when. Workspace admins can read observations, delivery metadata, current answer metadata, and current disagreement explanations. A rating without an answer, including its time, stays private. They cannot read private practice-page or conversation feedback text, how you rated it, or other private response notes. Taking back your answer removes its metadata from their current view.
* The public activity page shows contributions to public repositories only. Other workspace pages need sign-in. Hidden people and people who opted out do not appear or contribute to its totals. Contact the workspace privacy contact to object to publication.
* The About page lists the people who contribute to the Hephaestus open-source project, as GitHub shows them.
* Feedback on GitHub, GitLab, or Slack is visible to that destination’s audience.
* Instance admins can use **View as user** to read activity, practice pages, feedback, and existing conversations. This includes access before your first Hephaestus sign-in. Each read has a recorded reason. This access cannot send messages, answer questions, or make choices for you. It does not count as you seeing feedback. Workspace admins do not have this access.
* Instance operators can access stored data for operation and privacy requests. Instance admins can read product-feedback and survey submissions.

## Your choices and right to object

### Comments on your work

1. Open **User settings → Practice feedback**.
2. Turn off **Comments on your work** to stop new comments on your work.
3. To allow new comments again, turn it on.

**Reviews still run and admins can still see observations.** Neither action removes existing comments.

### Weekly digest

The [weekly digest](/user/ask-hephaestus.md#weekly-digest) is off until you turn it on in **User settings → Weekly digest**. When you turn it on, Hephaestus stores your time zone to know when your digest is due. The digest itself stays in your conversation. Its Slack or email note carries no feedback content, counts, or practice names. You can turn the digest off in User settings, from the Slack note, or with the link in the email.

### Your conversation

Hephaestus keeps your conversation in each workspace. This includes your messages, Hephaestus’s answers, and the context Hephaestus read to answer you. It also keeps the page you asked from, if you sent it with your message.

1. To erase one of your messages, select **Delete message** under it in the app.
2. To erase a message you wrote in Slack, delete it in Slack.

Deleting a message erases its text in Hephaestus, also from Hephaestus’s memory of the conversation. If a workspace admin removes the Slack app or disconnects Slack, Hephaestus erases the messages written in Slack in that workspace.

The upgrade that gave you one conversation per workspace deleted all earlier conversations. This covers conversations in the app and Slack direct messages stored in Hephaestus. Slack keeps its own copy of those direct messages. Feedback that Hephaestus showed you in them still counts as delivered. This removal is separate from an erasure request.

### Slack channel messages

1. In the Hephaestus App Home, select **Stop using my messages**.
2. To permit new collection, select **Allow future messages**.

The first action stops collection and erases collected channel messages and related conversation observations and feedback. The second does not restore deleted data. Neither erases your conversation, unrelated repository feedback, Slack’s copy, or [separately retained copies](#copies-outside-active-records).

### Research participation

1. Where offered, open **User settings → Research participation**.
2. Turn on **Allow research use of my data** to say yes.
3. Turn it off to withdraw.
4. For data already in a published dataset, contact your instance’s privacy contact.

The same section repeats the research summary and has **What this means** for the details. Giving consent and withdrawing it take the same single switch. Hephaestus records your answer with the date and the version of the text you saw. Slack App Home links to these account settings.

When you withdraw:

* New research use of your data stops.
* Research survey invitations stop.
* The research team removes your data from datasets that are not yet anonymized.
* Research done before you withdrew stays lawful.
* Anonymized data in a published result or dataset cannot be traced back to you, so it cannot be removed.
* Ordinary practice reviews continue.

Withdrawal does not erase other stored data by itself. [Delete your account or request wider erasure](#delete-your-account-or-request-wider-erasure) explains that step. Research is optional and separate from the terms. Saying no or withdrawing has no disadvantage, and you keep the same access, features and feedback. Research use of your data does not include browsing activity from the browser extension.

### Email notifications

Optional invitations, connection alerts, and admin updates start off where offered.

1. Choose each category in **User settings → Email notifications**.
2. To unsubscribe without sign-in, use the unsubscribe link in an email.

If you turn on the weekly digest and have not connected your Slack account, its note arrives by email. Without an email address, the digest is only in your conversation. The link in that email turns off the weekly digest.

**Research survey invitations** also require that you allow research use. Turning them off stops the emails, but it does not end your research participation. The mail relay receives your contact address, notification type, and links, not product-feedback text or survey answers. Account-security and deletion notices are separate from optional subscriptions.

### Object to processing

1. Contact your instance’s privacy contact to object or request access, correction, restriction, or erasure, as applicable.

Disabling comments, leaving a workspace, or never signing in does not stop processing. Your instance’s notice also explains how to complain to a supervisory authority.

## Respond to feedback

1. In a Hephaestus comment on GitHub or GitLab, find “Answer or disagree in Hephaestus”, and follow the **Hephaestus** link.
2. Select **Disagree**.
3. Give a reason for workspace admins to read.

The page shows your own reviews of that work. A standing disagreement withholds feedback about the same claim in later reviews of the same work. **Not applicable** also withholds feedback about that claim. Withdrawal of the disagreement allows that point again. Reactions or replies on GitHub or GitLab do not enter this process.

On your Practice profile, **Disagree** also records a disagreement. An admin can mark an observation incorrect or withdraw practice-page feedback with a reason, then restore it later. Unseen withdrawn feedback does not appear. Feedback you saw becomes a withdrawal notice. The original and its history stay stored, but its text leaves future review and conversation context.

Hephaestus cannot recall replies already sent, inline provider comments, or context already given to a review that still runs. A disagreement or withdrawal is not erasure.

1. For wider correction, restriction, or erasure, ask the privacy contact, including if you cannot use the app.

## Get a copy of your data

1. Open **User settings → Danger zone → Export your data → Request export**.
2. If the export fails, select **Request export again**.
3. For repeated failures or stalled exports, contact the operator.
4. When the export is ready, select **Download**.
5. Keep the downloaded file private.

Downloads expire **48 hours** after preparation. The JSON file includes your account, connected sign-in identities, memberships, account features, preferences, AI choice, and authentication history. It does not include credentials or session secrets.

**The self-service export is limited.** The privacy contact handles requests for these additional records:

* Conversations, observations, and feedback, including feedback never delivered.
* Activity records and mirrored source content.
* Product-feedback submissions and survey responses.
* Other retained copies.

An instance admin can resolve your exact provider identities, preview the scope, and download one JSON file for the wider request. It includes selected source content mirrored locally. It excludes credentials, other people’s profiles, raw Git objects, and the context documents that Hephaestus read for an answer. Access and portability are different rights. Statutory portability depends on the applicable consent or contract basis and other conditions.

1. Request additional records through your instance’s privacy contact.
2. Obtain original source-platform exports from those platforms separately.

You do not need a Hephaestus account for this procedure.

## Delete your account or request wider erasure

You cannot undo account deletion

Account deletion disables your account immediately and leads to permanent cleanup after the cooldown. There is no self-service undo. Do not delete your account to leave one workspace or sign out a device.

1. Open **User settings → Danger zone**.
2. Select **Delete account**.
3. In the dialog, enter the confirmation phrase.
4. Select **Delete account** again.
5. If the request was a mistake, contact the operator immediately.

Hephaestus immediately signs you out on all devices. If your instance sends email and your account has a verified address, it sends confirmation with the cleanup date. After the default **48-hour cooldown**, scheduled cleanup removes sign-in details, connected identities, AI choice, product-feedback submissions, and survey responses. An account record remains with contact details cleared. There is no self-service undo.

**Account deletion is not complete person erasure.** Contributor profiles, conversations, observations, feedback, and other retained copies require a wider request. A source disconnection or workspace removal is not a substitute. Deletion in Hephaestus does not delete original work on connected services.

With or without an account:

1. Send the instance’s privacy contact your workspace, relevant provider instance, native user ID, and links to affected work or feedback.
2. For Slack, also include its workspace ID.
3. If native IDs are unknown, send source-profile and work links for the operator to resolve them.
4. Do not send passwords, tokens, or unnecessary identity documents.
5. Include already-posted feedback explicitly.
6. Ask for the request’s scope, status, and any retention or lawful exceptions.

You do not need database IDs or sign-in to submit a request. The operator must verify which records belong to you. Names, logins, and email addresses are not matching keys. Correction or removal of posted feedback requires a separate operator request, with no guarantee of success.

The operator confirms the scope before erasure. Hephaestus records completion. Erasure stops affected reviews and removes their working evidence and affected private conversation memory. If a step fails or a worker is offline, the request stays incomplete until the operator resumes it.

Minimal exact native identity keys stay to prevent renewed product processing. Source sync may still mirror upstream records. The operator normally answers within one month. A justified extension of up to two more months requires notice within the first month.

## How long data stays

Each category has its own retention period. An operator can change several periods. [Data retention](/admin/data-retention.md) lists each period supplied with Hephaestus and identifies those the operator controls. Your instance’s privacy notice states which periods your deployment applies.

Scheduled removal starts after records become eligible and may need later successful runs to finish. The sections above describe account and export timing.

### Project content

* **GitHub and GitLab:** active copies stay while a workspace monitors the source. Removal of the last relevant connection or repository monitor removes them. Shared sources stay for other workspaces that monitor them. Contributor profiles can stay independently and require operator-assisted erasure.

  An unavailable repository, or one that loses access, keeps stored work while monitored. A removed GitLab note leaves live context only after successful reconciliation. Historical review copies do not change automatically.

* **Slack channel threads:** retention uses a rolling period measured from the latest message. An active thread can still contain much older messages. This period does not apply to your conversation.

* **Outline:** selected content stays while its collection and connection stay active.

* **Conversations and memberships:** records stay with the workspace. Workspace removal or verified person erasure removes them. Deleting one of your messages erases it sooner.

* **Product-feedback and survey submissions:** there is no automatic expiry by age. Account deletion, applicable workspace removal, or verified erasure removes them.

### Security and review history

* **Authentication history:** records expire in monthly batches. Account erasure redacts identifying authentication details.
* **Settings-change history:** records expire after their own retention period. Account erasure detaches actor references, not the change record.
* **Review diagnostics:** records become eligible for removal when enough time has passed since job completion. Job history becomes eligible later, only without observation or feedback references. Pending delivery delays both. The job-retention service must also be on. Disabling reviews does not automatically delete old records.
* **Review working copies:** cleanup removes worker attempt folders after evidence admission. Ended attempts have a one-hour cleanup grace period. Restart cleanup removes abandoned folders. Failed cleanup needs a later successful run. Raw Git mirrors follow repository monitoring. The repository owner must handle Git authorship at source.
* **AI usage accounting:** records contain token counts, costs, and run identifiers, not message content. They stay long enough for annual accounting. An operator can extend retention for a legal obligation.
* **Other operational and administration history:** some records of who configured or requested an operation have no automatic expiry. They survive account or workspace removal. A verified erasure request must include them.

### Copies outside active records

* **Buffered integration events:** supplied limits expire Slack and Outline events within hours, and GitHub and GitLab events within months. Storage limits can shorten retention. Individual erasure cannot selectively remove these copies.
* **Logs, support bundles, and backups:** container logs rotate by size, not age. The operator controls support-bundle and backup retention. These copies do not support immediate selective erasure. The operator can explain expiry and treatment of erased data after a restore.
* **AI-provider copies and posted feedback:** provider policies apply. Completed AI requests cannot be recalled. Posted feedback follows the separate removal process above.