01Who we are
Replicorg is a product of Univershala Technologies Private Limited, a company in India (“Replicorg”, “we”, “us”). This policy covers the website at replicorg.com and the app at app.replicorg.com.
Our registered office: Univershala Technologies Private Limited, PH 01, 6th Floor, Rich Homes, 5/1, Richmond Rd, Shanthala Nagar, Ashok Nagar, Bengaluru, Karnataka 560025, India.
Questions about this policy: hello@replicorg.com. Our grievance officer is listed in section 11.
02What we collect
Your GitHub account
You sign in with GitHub. We store your GitHub user ID, username, display name, email address and profile picture link, plus the access token GitHub issues to Replicorg, which we store encrypted. We record when you last signed in. Each time you sign in we check which GitHub organisations you belong to, so we know which workspaces you may open.
Your repositories
You or your organisation install the Replicorg GitHub App on the repositories you choose. With that access we:
- read code, issues, pull requests, reviews, comments, check results and GitHub Actions status, and receive GitHub's notifications about pull requests, reviews, comments and checks;
- write branches and commits, open pull requests, post comments on issues and pull requests, and merge a pull request when you have turned on automatic merging for that work or confirmed the merge;
- read the email addresses on your GitHub account and the members of your organisation.
We keep a short-lived copy of issue and repository lists so pages load quickly.
Your work in Replicorg
Tasks, plans, comments and settings you create; your instructions to coding agents; what the agents say and do (their messages, the commands they run and the terminal output); review results; and screenshots and recordings made while checking work. This is how you and your team follow and take over the work.
Credentials you give us
To run agents for you, you may give us sign-ins or API keys for coding agents (Claude Code, Codex, OpenCode), a key for your own sandbox provider account (Daytona) or model routing account (OpenRouter), environment variables and secrets your code needs, and tokens for tools you connect. If you use the Replicorg app on your own machine and ask it to keep an agent sign-in up to date, it reads that sign-in on your machine and sends it to us.
We store all of these encrypted (AES-256-GCM) and decrypt them only to do the work you asked for, for example by placing them in the sandbox that runs your task. You can remove them in the app at any time.
Tools you connect (optional)
- Slack: if you connect it, we post notifications to the channel you choose, and if you link your Slack account we store your Slack workspace and user IDs.
- Jira: if you connect it, we read and update the Jira issues you work on.
Tokens for connected tools are stored encrypted.
Voice (optional)
If voice is available in your app and you start a voice conversation with the in-app assistant, your browser asks for microphone access and sends your audio to our voice provider, ConverSimple. It turns your speech into text and sends us that text; we treat it as a message to the assistant and send back the reply for it to speak. We keep the text of the replies and the identifiers of the conversation. Voice only runs while you have it switched on. Voice is available in the production app. ConverSimple and its speech providers process audio for transcription and playback under their own policies.
Usage and billing
How long each Replicorg cloud sandbox ran, the credit added to and used by your workspace, and your plan. For payments we keep Razorpay's reference numbers (customer, subscription, order, payment and refund IDs), amounts, currency, status and billing period dates. We do not receive or store card numbers or bank account details; Razorpay handles those. For each payment notification from Razorpay we keep a fingerprint of the message, not its contents.
Activity records
We record significant actions, such as sign-ins, permission and member changes, credential changes and billing changes, with who did them and when, so workspace admins and we can see what happened.
Network information
Our hosting providers handle network traffic and may process IP addresses, request timestamps and diagnostic information for security and operation under their own retention policies.
03How we use it
- To run the service you ask for: run agents, open pull requests, start previews, and move work between your machine and the cloud.
- To sign you in and decide what you may see and do.
- To measure cloud time, apply credit, take payments and stop cloud work when credit runs out.
- To send the notifications you have set up.
- To keep the service secure, investigate problems and prevent abuse.
- To answer you when you contact us, and to meet our legal obligations.
We do not sell your personal data.
04Your workspace and its admins
A workspace belongs to the organisation that set it up. Members see its tasks, comments and agent activity according to their role. Workspace admins can also add and remove members, change roles, manage shared credentials and connected tools, and manage billing. If your organisation runs your workspace, it decides who sees this information, and you may need to ask your admin for some changes.
05AI models
Your code and instructions reach AI models in two ways.
Coding agents
Claude Code, Codex and OpenCode run inside the sandbox with the credentials you supplied. They send your code and instructions to the model provider you chose (Anthropic, OpenAI, or OpenRouter), under your own account with that provider and its terms. Replicorg does not resell or mark up these model calls.
Replicorg's own assistant features
The in-app assistant, codebase summaries, lessons drawn from finished work, and planning of browser checks send the relevant text (your messages, task details, and a summary index of the repository) to a model through OpenRouter. By default this uses Replicorg's OpenRouter account and a model we choose; a workspace admin can switch it to the workspace's own OpenRouter account.
We do not use your customer code to train AI models. Model providers process the inputs needed to provide their services and have their own retention and training policies. Where you supply provider credentials, your account settings and agreement with that provider apply. This policy does not promise zero retention or a no-training setting for every third-party provider.
06Where your code runs
- Replicorg cloud sandboxes run on Daytona, a third-party sandbox provider. We copy your repository into the sandbox, together with the credentials and environment variables the task needs. Processing locations depend on the sandbox provider and target configured for the workspace; we do not promise that sandbox processing remains in India.
- Your own Daytona account, if you connect one, works the same way under your account with Daytona.
- Your own machine: the Replicorg app runs tasks in containers on your computer or server. The working files are held on your machine; we receive agent messages, terminal output and status, and coding agents still send relevant code to their model providers.
- Moving work between your machine and the cloud copies the workspace through our servers, stored encrypted.
- Our servers also make short-lived copies of a repository to work out how to set it up and to push branches for pull requests.
09How long we keep it
- Cloud sandboxes: when a task's work finishes, fails or is stopped, we shut down its cloud sandbox (we check every 30 minutes). A sandbox that may hold the only copy of unfinished work after a failed move is kept until that is resolved.
- Credentials: kept until you remove them or your workspace is closed.
- Share links for screenshots and recordings stop working when they expire.
- Account, workspace and task history: kept while your account or workspace is active. You can request deletion at hello@replicorg.com. After verifying your request and authority over the data, we delete it within 30 days, except records that must be retained by law. Tell us whether retained recovery workspaces should also be deleted; a deletion request covering them ends their recovery protection.
- Billing records: kept for the period required by applicable accounting, tax and other legal obligations. These may remain after an account deletion.
- Logs: kept only as needed to operate and secure the service, investigate incidents and meet legal obligations. On a verified deletion request, personal data in logs under our control is deleted or anonymised within 30 days unless retention is required by law.
10Security
Connections to the app use HTTPS. Credentials, connected-tool tokens, your code's secrets and moved workspaces are encrypted in our database. Each workspace's data is kept separate from other workspaces. Tasks run in isolated sandboxes, which may be reused or shared for configured workflows. No system is perfectly secure; if a personal data breach affects you, we will tell you and the authorities as the law requires.
11Your rights
You can ask us to take the following actions, subject to identity verification, applicable law and the rights of your workspace:
- tell you what personal data we hold about you, what we do with it, and who we have shared it with;
- correct, complete or update it;
- erase it when it is no longer needed for the purpose you gave it for, unless the law requires us to keep it;
- withdraw your consent. Withdrawing stops future use but does not undo what we did before, and you may no longer be able to use the parts of Replicorg that need that data;
- nominate someone to act for you if you die or become unable to act;
- resolve a complaint through our grievance officer. You may also seek remedies from the relevant authority where applicable law provides them.
You can also act yourself: remove credentials and connected tools in the app, uninstall the Replicorg GitHub App, or revoke Replicorg's access in your GitHub settings.
Write to hello@replicorg.com or to our grievance officer, Faraz Haider, at hello@replicorg.com. We will review your request and contact you at the email address you provide. We may need to confirm it is you before acting.
12Children
Replicorg is for professional use and is not meant for children. You must be at least 18 years old to use Replicorg.
13Data outside India
Our app and database run in Singapore, and the providers above process data in other countries, including the United States. We transfer data abroad only as Indian law allows.
14Changes to this policy
If we change this policy we will update this page and its effective date. For significant changes we will also tell you by email or in the app at least 30 days before they take effect, except where an earlier change is required by law or necessary to address an urgent security risk.