Privacy Policy

Last updated: 18 October 2026

1. Who we are

CodeValue is supplied by NullH, ABN 88 797 576 775, Australia. Contact for privacy questions and requests: codevalue@nullh.xyz. We handle personal information in line with the Australian Privacy Principles.

2. What we collect

  • Account: your email address, name and any profile details you add; a password hash if you sign up with a password (never the password itself).
  • GitHub: if you connect GitHub, your GitHub username, profile picture link and verified email address, and an access token, stored encrypted, so we can read the repositories you choose.
  • Evaluations and listings: the repository, branch and commit you choose, the analysis results (file paths and hashes, dependency lists, vulnerability and scan findings, scores), and the text and settings of your listings.
  • Credits and purchases: your credit balance and its history, and for each purchase the pack, amount, GST, billing country, Stripe’s payment references and how the payment settled. Card details go to Stripe, never to us.
  • Security records: sign-in events and security-relevant actions, with the IP address of the request.

3. Your source code

  • We do not accept uploads. When you ask for an evaluation, we download your repository at a pinned commit into temporary storage on our server, analyse it without ever executing it, and delete the working copy when the analysis finishes. We keep the analysis results listed above.
  • Your repository name, link and branch are private unless you choose to show them. Commit identifiers and hashes appear on public certificates.

4. AI processing

Only if you allow it for a listing, short excerpts of your code (the README and the opening lines of a sample of source files, up to about 60 KB) and the evidence summary are sent to Anthropic to draft the listing description, review findings and your private coaching. If Anthropic is unavailable, a model running on our own server may be used instead. Without your permission, no repository content is sent to any AI provider. AI never sets your technical index.

5. How we use it

To run your account and sign you in; to evaluate your code and issue certificates; to sell and account for credit packs, including tax invoices and GST records; to prevent fraud and abuse and keep the service secure (rate limits, lockouts, alerts); and to send you service emails (email confirmation, password resets, notifications about your evaluations). We do not sell personal information, and we use no advertising or analytics trackers.

6. Who processes it, and where

  • Hetzner hosts our server, so all stored data is held in its data centre, outside Australia. Our email is sent from our own mail server on the same infrastructure.
  • GitHub (United States): sign-in and access to the repositories you choose.
  • Anthropic (United States): the AI processing in section 4, only with your permission.
  • Stripe (Australia and the United States): card payments for credit packs.
  • OSV.dev, run by Google (United States): the names and versions of your code’s open-source dependencies, to check them for known vulnerabilities.
  • The public: published listings, their technical index, price range and certificates; your repository’s identity only if you choose to show it.

So your information is disclosed outside Australia — to the United States and to our hosting provider’s country. These providers process it to deliver the service under their own security and privacy commitments.

7. Cookies

Only cookies the service needs: reporank_session keeps you signed in, and github_oauth_state protects a GitHub sign-in and is removed when it finishes.

8. Security

Passwords are hashed; GitHub tokens are encrypted, with the keys held in a separate secrets vault, never in configuration files; connections use HTTPS; an operator’s money and repair actions need a recent GitHub sign-in with two-factor authentication, and security-relevant actions are logged. No system is perfectly secure: if a data breach is likely to cause you serious harm, we will tell you.

9. How long we keep it

  • Account, evaluation and listing data: while your account is open. Deleting a listing takes it off CodeValue and out of search and purges any code stored for it; its record and analysis results stay with your account, not public, until the account is closed.
  • Purchase, GST and payment records: five years, as Australian tax law requires.
  • Security records: as long as they are needed to protect the service and your account.
  • Backups: daily backups are kept for 14 days; a backup taken before a software release is kept until an operator removes it.

10. Your choices and rights

Email codevalue@nullh.xyz to access or correct your information, or to close your account and have it deleted — except records we must keep (section 9). If you are not satisfied with how we handle a privacy complaint, you can contact the Office of the Australian Information Commissioner (oaic.gov.au).

Changes to this policy are dated here. See also the Terms of Service.