Built with security by default

Read-only GitHub access

BlueFairy connects to your repositories via a GitHub App with read-only permissions — enforced at the API level by GitHub itself. We can read commit history and pull request activity. We cannot write code, create branches, delete repositories, or make any modification to your codebase. Write access is structurally impossible, not just a policy.

GitHub App permissions

Write access is structurally impossible

Your code doesn't train AI models

Repository context is sent to Google's Gemini API on a paid tier, where Google's terms explicitly prohibit using API data to train models. Your code is used only to generate a response and is not retained by Google beyond that request. BlueFairy does not store raw source code or file contents at any point.

Auth handled by GitHub, not BlueFairy

BlueFairy never stores or handles passwords. Authentication is delegated entirely to GitHub's OAuth system and managed by Supabase. We request only the minimum scope — read:user — granting identity information only. Session tokens are issued by Supabase and transmitted exclusively over HTTPS.

Auth flow

Encrypted storage, GDPR-compliant

All data is encrypted at rest using AES-256 via Supabase and in transit via TLS across all services. BlueFairy operates as a GDPR-compliant data processor under a published Data Processing Agreement. Your data is fully deleted within 30 days of account closure — we do not archive or retain it beyond that.