Privacy Policy
This policy explains what information Yggdrasil handles when you use the hosted service at app.yggdrasil.cfd, and the choices you have. The short version: we collect what the service needs to operate — your GitHub identity, the repositories you connect, and the jobs you run — and nothing is sold or shared for advertising.
01Information we collect
- GitHub account information. When you sign in with GitHub we receive your GitHub username, display name, avatar, and the identifiers needed to authenticate you. Yggdrasil has no separate password of its own.
- Repository access and metadata. When you install the GitHub App on a repository, Yggdrasil receives the repository metadata and the scoped access GitHub grants it. Repository contents are checked out inside isolated, per-job environments to run builds and tests.
- Project and job data. The projects, feature descriptions, specifications, chat messages, job logs, and test results you create while using the service.
- Secrets you store. Model-provider API keys and project secrets you save are encrypted at rest and decrypted only server-side, when a job that needs them runs.
- Operational data. Standard service logs (timestamps, request metadata, error traces) used to keep the service running and debug failures.
02How we use it
We use this information solely to operate the service: authenticating you, dispatching and running agent jobs against your repositories, streaming progress back to you, deploying previews you request, and diagnosing failures. We do not sell your data, and we do not use your code or content for advertising.
03Where your code goes
Agent jobs run inside isolated, ephemeral environments that are torn down when the job finishes. To generate code, relevant portions of your repository and your instructions are sent to the model provider you have configured for your project (for example OpenRouter, Anthropic, or OpenAI) under your own API keys. Those providers process that data under their own terms and privacy policies — review them before connecting a provider.
04Third-party services
Yggdrasil does not embed third-party analytics or advertising trackers.
- GitHub — identity, repository hosting, and pull requests. Governed by GitHub's own privacy statement.
- Model providers you configure — inference for agent runs, under your keys and their terms.
05Self-hosted deployments
If you run Yggdrasil on your own infrastructure, your code, secrets, and job data stay on systems you operate — this policy applies only to the hosted service. The operator of a self-hosted deployment is responsible for its own privacy practices.
06Retention and deletion
Project and job data is retained while your account is active so you can review the history of what was built and why. Ephemeral job environments are destroyed when a job completes. If you disconnect the GitHub App, Yggdrasil loses the access it granted. You can request deletion of your account data via the contact below.
07Security
Security is a design constraint of the product itself: jobs run in isolated environments with no access beyond what each job needs, repository access uses scoped and short-lived tokens rather than standing credentials, and stored secrets are encrypted at rest and decrypted only server-side. No system is perfectly secure, but the architecture is built to limit the blast radius of any single component.
08Your choices
- Uninstall the GitHub App from any repository at any time to revoke Yggdrasil's access to it.
- Remove stored secrets and provider keys from your project settings at any time.
- Request a copy or deletion of your account data via the contact below.
09Changes to this policy
We may update this policy from time to time. Material changes will be announced on this page with an updated "Last updated" date.
10Contact
Questions about privacy can be raised on GitHub.