Privacy Policy
What we collect, why, and how we look after it
Last updated April 19, 2026
Plain-English summary
Reform helps you analyze and improve the user interface of websites you own. To do that we look at code you give us access to, generate suggestions with AI, and (optionally) collect anonymized visitor behavior on sites where you install our tracking script. We don't sell your data, we don't track form values, we don't use cookies for analytics, and we don't store individual visitors' identities.
Information we collect
Account information
When you sign in with GitHub, we store your GitHub user ID, username, email address, and avatar URL. That's it.
Repository contents you authorize
With your permission (granted via GitHub OAuth), Reform reads files from repositories you select. We use those files to detect your framework, generate previews, and produce suggested changes. We don't store every file forever — code is held only as long as we need it to run the analysis you requested.
Visit behavior on sites where you install the tracker
If you install the Reform heatmap script on a site you own, we collect aggregated behavioral signals from your visitors: where they click, where they move their cursor, how far they scroll, and which pages they view. We do not collect form values, text the visitor typed, cookies, localStorage contents, or any third-party data. Coordinates are stored as percentages of the page, never as exact pixels, and individual events are aggregated into 50×50 heat buckets — raw events are never stored.
Billing information (if you upgrade)
Payments are processed by Stripe. We never see or store your full card number. Stripe sends us back a customer ID, the plan you're on, and renewal status.
Operational logs
Standard server logs (IP address, request path, timestamp, user agent) are retained for up to 30 days for security and debugging. We don't use them for marketing.
How we use it
- · To run the analyses, transformations, and previews you ask for.
- · To show you heatmaps, version comparisons, and AI recommendations for your sites.
- · To open pull requests on your behalf when you click "Install tracking automatically".
- · To bill you (if you're on a paid plan) and to renew or cancel your subscription.
- · To debug failures and protect the service from abuse.
Who we share it with
Anthropic
We send code snippets and behavior summaries to Claude (Anthropic's API) to generate transformations and recommendations. Anthropic doesn't train on this data per our API contract.
GitHub
When you authorize the GitHub integration, requests to read your repos and open pull requests are made directly against the GitHub API on your behalf.
Stripe
For payments and subscription management.
Hosting providers
Vercel hosts the dashboard. Railway hosts the backend. AWS S3 stores screenshots and larger artifacts.
We don't sell, rent, or trade your data with anyone else.
How long we keep it
- · Account data: while your account is active.
- · Project & transform history: while your account is active, or until you delete it.
- · Heatmap aggregates: while you keep the tracker installed and the site connected.
- · Server logs: 30 days.
- · Billing records: as long as required by law (typically 7 years).
Your choices
See or export your data
Email us (below) and we'll send you a copy of what we have for your account.
Delete your account
Email us with the address tied to your account and we'll delete everything within 30 days, except records we're required to keep for billing or compliance.
Visitor opt-out (heatmaps)
Our tracker honors navigator.doNotTrack === '1'. Visitors with Do Not Track enabled load the script but emit nothing.
Security
All traffic is over HTTPS. Production secrets are stored in our hosting providers' secure config. Database connections are TLS. We follow the principle of least privilege and we don't store your GitHub access token longer than the active session needs it. No system is perfectly secure — if you ever notice a vulnerability, please reach out at the address below.
Children
Reform is a developer tool and isn't directed at children under 13. We don't knowingly collect data from children.
Changes to this policy
If we change anything material, we'll bump the "Last updated" date and (if you have an account) email you in advance. Continued use after a change means you accept the new version.
Contact
Questions, deletion requests, or anything else: hamza.daqa@gmail.com.