Privacy policy

What the app receives

The app needs one thing you provide: the repository you ask about, given as its owner and name or as a link to it on GitHub. Your AI assistant passes this to the app when you ask it to survey a repository. Without it, the app cannot run the survey.

The app does not see your conversation, your name, or your accounts. It does not ask you to sign in.

What the app does with it

The app uses the repository name to ask GitHub for that repository’s public details, its workflow files, and its canfail.json file if it has one. It surveys public repositories only. It reads these files and runs nothing.

These requests go from the app’s server to GitHub, not from your device. They use a read-only key that belongs to us, so GitHub sees which repository was asked for, but not who asked.

The app sends the summary back to your AI assistant, which shows it in your conversation. Our code does not save the repository name or the result, and it does not keep a record of what you ask.

Hosting and analytics by Alpic

Alpic, a company based in France, runs the server the app lives on. Every request to the app passes through Alpic. For each request, Alpic’s analytics record:

• the kind of request and the tool called;
• the name of the AI assistant that sent it, such as Claude or ChatGPT;
• the time, how long the app took to answer, and an estimate of the answer’s size;
• the type of error, if the request failed;
• a session identifier, which groups the requests from one connection.

ChatGPT also sends Alpic a stable identifier for each ChatGPT user, and an identifier for the conversation. These identifiers do not show who you are, but they are still personal data, because they let Alpic tell one user’s requests from another’s. Alpic uses them to count users and group sessions. Claude sends neither, so Alpic’s analytics cannot tell Claude users apart.

Alpic’s documents say its analytics never collect IP addresses, or the content of requests and answers. That means Alpic’s analytics do not record the repository you ask about. You can read what Alpic records in its analytics documentation, and how Alpic handles personal data in Alpic’s privacy policy.

When the app shows its interactive view, your device loads the view’s files from Alpic’s servers. Like any website, those servers see your device’s IP address and browser details when they send the files. Depending on your assistant, the app’s requests reach Alpic either from the assistant provider’s servers or, for an assistant that runs on your own computer, from your device. If the server hits an unexpected fault, a technical error message can also be written to Alpic’s server log.

Links in the view open GitHub or our Seen to Fail site. Each site’s own privacy policy applies once you follow a link.

Our lawful basis

Under UK GDPR, our lawful basis is legitimate interests (Article 6(1)(f)). Our interests are to give you the survey you asked for, and to keep the app running, secure, and working well, which is what Alpic’s request records are for. We consider this a limited and expected use. Alpic’s analytics records hold no names or contact details, and they are kept for 7 days. The app makes no automated decisions about you.

Sharing and third parties

We do not sell data, and we do not use it for advertising. The parties that receive your request, or data about it, are:

• Alpic, our host and processor, as described above. Alpic uses its own providers to run its service, including Amazon Web Services for hosting. Alpic says it can give a full list of these on request.
• GitHub, which receives the name of the repository you ask about, as described above, but nothing about you.
• Your AI assistant’s provider, such as Anthropic for Claude or OpenAI for ChatGPT. Your conversation, and the summary the app returns into it, are handled by that provider under its own privacy policy. We do not see your conversation.

Where data is processed

Alpic is based in France. UK law treats France, as part of the European Economic Area, as giving adequate protection, so data can go there from the UK.

Some of the providers Alpic uses are in the United States. Alpic says it protects these transfers with standard contractual clauses or the EU-US Data Privacy Framework, as described in section 7 of Alpic’s privacy policy. Those are EU safeguards. A transfer of UK data also needs a UK safeguard, such as the UK addendum to those clauses or the UK extension to that framework. Alpic’s published documents do not say which it uses. We have asked Alpic, and we will update this page when we know.

How long data is kept

We keep nothing ourselves. Alpic keeps its analytics records for this app for 7 days, the retention period of the plan we use. Alpic’s published documents do not say how long its servers keep the connection logs that hold IP addresses. We have asked Alpic, and we will update this page when we know.

Your rights

UK data protection law gives you rights over your personal data, including the right to access, correct, and erase it, and to restrict how it is used.

You have the right to object. Because we rely on legitimate interests, you can object at any time to the processing described on this page. To stop new processing, stop using the app or remove it from your AI assistant. Records already made are kept for the periods set out above, unless you ask us to have them erased.

We hold no data about you ourselves, and the records Alpic keeps for us do not contain your name or contact details. If you want to use any of your rights, email us and we will work with Alpic to help, as far as the records allow. Contact us at privacy@async-digital.com. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK regulator for data protection, at ico.org.uk.

Children

Can it fail? is a tool for software developers and is not aimed at children. It is not designed to collect personal data from anyone, including children, beyond what this page describes.

Changes to this policy

If we change how the app handles data, or where it is hosted, we will update this page and change the date at the top. The current version always lives at this address.

Contact

Async Digital Ltd
167–169 Great Portland Street, London, W1W 5PF
Registered in England & Wales, company number 16950485
ICO registration ZC271795
Director: Rob Nash
Privacy contact: privacy@async-digital.com