COPPICE

COPPICE

Privacy Policy

Last updated 11 September 2026

Coppice is a gardener for vibe-coded repos. It is operated by TekReign. This policy describes data practices for coppice.tekreign.com, the Coppice VS Code / Cursor extension, and GitHub OAuth.

Coppice is not a cloud IDE and does not clone or scan your GitHub repositories as the product. Architecture scans run on your machine in Cursor. This site stores history you choose to upload after you sign in.

What we collect

  • Account. If you register with email we store that address and a hashed password. We do not store the password in plain text. You can later connect GitHub to the same account so we can list repositories.
  • GitHub account. When you log in with GitHub or connect GitHub from Integrations we receive your GitHub user id, login, display name, avatar URL, and email (if GitHub provides it). We store an OAuth access token so we can list repositories you can link.
  • Linked projects. Repo id, owner, name, and owner/name for repositories you explicitly link.
  • Scan history. If you sign the extension into Coppice, we may store contract JSON and findings JSON from a local Scan Workspace or Agent Scan, plus kind (engine or agent), finding count, and time.
  • Fix jobs. When you click Fix in Cursor, we store the finding JSON and a pending/running/done status so the signed-in extension can start a Cursor cloud agent that opens a new PR. We do not store a Cursor API key.
  • Extension token. A Coppice API token you mint on /connect, Settings, or Connections, or paste into the Cursor extension after Coppice: Sign in to Coppice. We store a hash and a short prefix so you can see that a token was added after you log in. We do not store the raw token after mint. The raw token stays in Cursor Secret Storage.
  • Billing. If you subscribe, Stripe stores the card. We store Stripe customer and subscription ids and whether the account is Premium. We do not store full card numbers.
  • Session cookies. Django session and CSRF cookies so you stay signed in on this site.

We do not collect a Cursor API key on this website. Agent Scan keys stay in the editor.

How we use it

  • Sign you in and show your dashboard.
  • List GitHub repos so you can link a project.
  • Show scan history for linked repos.
  • Overlay uploaded Coppice findings on open pull requests and issues for linked repos (ticket / PR-wise review) and compare Local scan vs Agent Scan (agent-wise review).
  • Accept scan uploads from the extension when you have signed in.
  • Queue a finding fix for the Coppice extension to start a Cursor cloud agent that opens a new PR.

We do not sell your data. We do not use it for advertising.

GitHub scopes

Coppice requests read:user, user:email, and repo so we can identify you and list repositories (including private ones you can access) for linking. For advanced review we also list open pull requests and issues on linked repos, and PR file names so we can attach existing Coppice findings. When you create a task from a finding we may open a GitHub issue, update Coppice status labels, submit a PR review, or merge a PR you asked us to merge. We do not use those scopes to clone your tree or run Coppice against GitHub as a cloud scanner.

Who we share with

See Third-party services. The identity provider is GitHub. Card payments go through Stripe. Hosting for the public site may be Vercel. Scan APIs, if deployed, run on our Django host, not on GitHub.

Retention and deletion

You can delete your Coppice account from Settings → Delete my data. That removes the account, GitHub links, uploaded scan history, board jobs, and hashed extension tokens. Cursor files such as COPPICE.md stay on your machine. If you have Premium we try to cancel the Stripe subscription; you can also cancel in the Stripe portal. Sign out ends the browser session. Revoke Coppice on GitHub → Settings → Applications to cut off the OAuth token. Questions: TekReign support.

Security

OAuth secrets belong in environment variables, not the git repo. Extension tokens are hashed at rest. CVE matching in the engine uses lockfile versions via OSV; this site does not invent CVEs.

Contact

Privacy questions: www.tekreign.com/contact-us or Coppice support.