abbox

Privacy policy

Last updated: November 9, 2026

Overview

abbox ("we," "us," or "our") connects to your GitHub repositories, analyzes your code, and opens your own website in the abbox viewer so your team can see how each part of the product works, ask questions about it, and request changes as pull requests. This policy explains what we collect when you use our website, the viewer, and these features, and how we use it.

Information we collect

  • Account data — your email address and password (stored only as a secure hash), and the projects and repositories you set up.
  • Repository code — through the abbox GitHub App you install, we read the code of the repositories you connect, at each commit we analyze. When you use Fix it, we also create a branch and a pull request in that repository.
  • Analysis results — what we derive from your code (pages, components, buttons, forms, texts, analytics calls, and how they change between commits), together with AI-written descriptions of them.
  • Conversations and requests — questions you ask about your product and the answers, bug reports you write, and design changes and fixes you request.
  • Activity on your website while it is open in the viewer — when your team opens your site in the viewer, the abbox inspector installed on your site keeps the last minute of activity in that browser tab: clicks, pages visited, form submissions, errors, and network requests (method, address without its query string, status and timing). It never records what is typed into fields, password fields, or request contents, and it only sends this to us when someone reports a bug. It does not run for your visitors outside the viewer.
  • Your analytics numbers — if you connect PostHog, you sign in to it and choose one project, and we get read-only access to that project. We then read totals from it: event and page-view counts per page, how they change over time, which pages visitors move between, the devices, traffic sources and countries behind those views, and error types with a short part of their messages. We do not read session recordings or individual visitor profiles. We keep your access tokens encrypted, and hold the totals only for a short time so that opening the viewer does not query PostHog each time.
  • Website and usage data — logs such as IP address, browser type and pages viewed, used to run and secure the service. On abbox.com we also use PostHog to record pages viewed, clicks, how far you scroll, errors and page speed, and to replay visits to our public pages, with anything typed into forms hidden. If you are signed in, this is tied to your account by its id, not your email address. We do not replay signed-in pages.
  • Website reports — when a report is made for a website, we read some of its public pages and keep a snapshot of them. When someone opens a report link, we record that it was opened, the country it was opened from (as our network provider estimates it), and whether it was on a phone, tablet or computer. We do not keep the IP address: we keep a one-way code made from it and the browser, so that repeat visits by the same person count once.
  • Access tokens for coding agents — if you connect a coding agent, we keep a one-way hash of each token you create, its name and when it was last used. A token can only read summaries of your own workspace's projects, and you can revoke it at any time.
  • Contact and demo requests — your email address when you request early access, and the details you give our scheduling provider when you book a demo.

How we use information

  • To provide abbox: analyze your code, show it in the viewer, compare commits, and answer questions;
  • To open pull requests in your repositories when you ask for a fix;
  • To find the cause of bugs you report;
  • To show how your product is used, on the pages of your own site;
  • To authenticate you, secure the service, and prevent abuse;
  • To respond to support, early-access and demo requests;
  • To understand how abbox.com is used and improve it;
  • To comply with legal obligations.

AI processing

To describe your product, answer questions, analyze bugs and draft fixes, we send the relevant parts of your code and analysis, and your question or request, to an AI model provider (currently Amazon Bedrock). When you ask about something tracked, this can include its analytics numbers. It processes this only to return results to us. We do not use your code, analysis or conversations to train AI models. AI output can be wrong; changes it proposes reach your code only as pull requests you review.

Service providers

We do not sell your personal information. We share it only with providers that help us run abbox, under contracts that limit their use of it:

  • GitHub, to read your repositories and open pull requests;
  • Amazon Web Services, for our servers and file storage (Frankfurt, Germany) and AI models (Amazon Bedrock, processed in AWS EU regions);
  • Supabase, for our database;
  • Vercel and Cloudflare, to host and deliver the website and viewer;
  • PostHog, for usage statistics on abbox.com, and to read your analytics numbers if you connect it;
  • Calendly, when you book a demo.

We may also disclose information if required by law or to protect our rights and users.

Cookies and storage

We use cookies to keep you signed in and to protect forms against cross-site requests. The viewer keeps your current session and preview address in your browser so a refresh reopens your project, and the website remembers your light or dark theme. PostHog uses a cookie and browser storage on abbox.com to recognize returning visitors.

Your website's visitors

The inspector you add to your website only becomes active when your site is opened in the abbox viewer by your team. If your site handles personal data of others, you are responsible for any notice your users need about this; when we process that data on your behalf, we do so only to provide abbox to you. The same applies to the analytics you connect: those totals describe your visitors, and error messages can contain whatever your site put in them.

Retention

We keep account data, analyses, conversations and bug reports while your account is active or as needed to provide the service. Viewer sessions expire after 30 minutes. Disconnecting PostHog deletes your access tokens from abbox and asks PostHog to revoke them. You can delete a project, or your whole account and all its data, yourself: Delete project is at the bottom of each project page, and Delete account is on your Account page. Both remove the database records and stored files at once. Some records may be kept where we have a legal obligation or a legitimate need, such as security logs.

Your choices

You can remove a repository from abbox, uninstall the abbox GitHub App in your GitHub settings, disconnect PostHog on your project page, and remove the inspector from your website at any time. Depending on where you live, you may have rights to access, correct, export or delete your personal data. Contact us to exercise them.

Security

We use reasonable technical and organizational measures to protect information, including encrypted connections and short-lived, single-use links for opening the viewer. No method of transmission or storage is completely secure.

Children

abbox is not directed at children under 16, and we do not knowingly collect their personal information.

Changes

We may update this policy from time to time. We will post the revised version on this page and update the "Last updated" date.

Contact

Questions about privacy? Email kamran.elchuzade@abbox.com or visit our contact page.