Privacy Policy

Last Updated: October 2026

Wharby ("we", "our", or "us") provides managed code review and repository hosting services at wharby.dev. This Privacy Policy describes what information we collect, how we use it, and your choices regarding your data.

1. Information We Collect

• Account & Profile Information: When you sign in via an external Identity Provider (such as Google or GitHub), we receive your account identifier, email address, display name, and avatar URL.
• Organization & Group Membership Metadata: To evaluate workspace access control rules configured by your workspace administrator, we query the group or organization/team memberships associated with your authenticated identity.
• Git & Code Review Content: We store the Git repositories, commits, patchsets, review comments, and SSH public keys that you or your team upload to your workspace.
• Service & Audit Logs: We record operational logs and security audit events (such as login timestamps and administrative configuration changes) necessary to maintain service reliability and security.

2. Third-Party Identity & OAuth User Data Policy

2.1 General Identity & OAuth User Data Policy

Across all supported Identity Providers, Wharby accesses and processes third-party identity and membership claims strictly to:

1. Authenticate your identity when signing into Wharby (wharby.dev and <workspace>.wharby.dev).
2. Evaluate zero-trust Access Grants configured by workspace administrators (matching by email address, email domain, group, or organization/team).
3. Synchronize authorized roles with your workspace's Gerrit Code Review instance.

Wharby never sells user data, never shares user data with advertising networks, and never uses customer source code, review metadata, or identity data to train artificial intelligence or machine learning models.

2.2 Google OAuth & Google API Services User Data Policy (Limited Use)

When you authenticate using Google, Wharby requests the following OAuth 2.0 scopes:

• openid, email, and profile: To verify your identity and primary email address.
• https://www.googleapis.com/auth/cloud-identity.groups.readonly: To query your direct Google Workspace / Cloud Identity group memberships (engineering@acme.com) during sign-in so that workspace group access grants can be evaluated.

Limited Use Disclosure: Wharby's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

2.3 GitHub App & OAuth Data Policy

When you authenticate using GitHub or install the official Wharby GitHub App (https://github.com/apps/wharby), Wharby accesses:

• Account Email Addresses (Read-only): To verify your primary email address for workspace attribution.
• Organization & Team Membership (Members: Read-only): To evaluate organization (acme-corp) and team (acme-corp/core-devs) access grants and process real-time membership revocation webhooks.
• Repository Metadata, Pull Requests & Checks (when enabled by an organization): Used solely to synchronize pull requests and report Gerrit code review verification statuses back to your connected GitHub repositories.

3. Data Sharing, Retention & Deletion

• Service Providers: We use industry-standard cloud infrastructure and payment processing providers solely to host and operate the Wharby service.
• Data Retention & Deallocation: Workspace data is retained for as long as the workspace remains active. When a workspace owner deallocates a workspace, its repositories, review records, and workspace account records are permanently deleted.

4. Contact Us

If you have questions about this Privacy Policy or wish to request account or workspace data deletion, please contact us at:

• Email: wharby-support@googlegroups.com