Privacy Policy

Coppice is a gardener for vibe-coded repos. It is operated by TekReign. This policy describes data practices for coppice.tekreign.com, the Coppice VS Code / Cursor extension, and GitHub OAuth.

Coppice is not a cloud IDE and does not clone or scan your GitHub repositories as the product. Architecture scans run on your machine in Cursor. This site stores history you choose to upload after you sign in.

What we collect

• GitHub account. When you click Authorize GitHub we receive your GitHub user id, login, display name, avatar URL, and email (if GitHub provides it). We store an OAuth access token so we can list repositories you can link.
• Linked projects. Repo id, owner, name, and owner/name for repositories you explicitly link.
• Scan history. If you sign the extension into Coppice, we may store contract JSON and findings JSON from a local Scan Workspace or Agent Scan, plus kind (engine or agent), finding count, and time.
• Extension token. A Coppice API token you mint on /connect. We store a hash, not the raw token. The raw token stays in Cursor Secret Storage.
• Session cookies. Django session and CSRF cookies so you stay signed in on this site.

We do not collect a Cursor API key on this website. Agent Scan keys stay in the editor.

How we use it

• Sign you in and show your dashboard.
• List GitHub repos so you can link a project.
• Show scan history for linked repos.
• Overlay uploaded Coppice findings on open pull requests and issues for linked repos (ticket / PR-wise review) and compare Local scan vs Agent Scan (agent-wise review).
• Accept scan uploads from the extension when you have signed in.

We do not sell your data. We do not use it for advertising.

GitHub scopes

Coppice requests read:user, user:email, and repo so we can identify you and list repositories (including private ones you can access) for linking. For advanced review we also list open pull requests and issues on linked repos, and PR file names so we can attach existing Coppice findings. We do not use those scopes to clone your tree or run Coppice against GitHub as a cloud scanner.

Who we share with

See Third-party services. The identity provider is GitHub. Hosting for the public site may be Vercel. Scan APIs, if deployed, run on our Django host, not on GitHub.

Retention and deletion

Account and linked-project data stay until you disconnect GitHub or ask us to delete them. Sign out ends the browser session. Revoke Coppice on GitHub → Settings → Applications to cut off the OAuth token. Contact TekReign support to request deletion of dashboard history.

Security

OAuth secrets belong in environment variables, not the git repo. Extension tokens are hashed at rest. CVE matching in the engine uses lockfile versions via OSV; this site does not invent CVEs.

Contact

Privacy questions: www.tekreign.com/contact-us or Coppice support.