Privacy boundary
Your project stays yours.
The deterministic alpha is intentionally local and narrow: the scanner does not upload project data, and there is no FirstRung account or product analytics layer. Optional email feedback is a separate channel with the boundaries described below.
AI Coach is separate, opt-in, experimental, and not part of the default CLI.
01
Data flow
What happens today
| Surface | What it reads | What leaves the device | What it writes |
|---|---|---|---|
| firstrung doctor | Node, npm and Git versions; an optional local repo path. | No FirstRung upload. | Terminal guidance only. |
| firstrung scan | The selected Git project and derived Git/path metadata. | No FirstRung upload. | Terminal feedback; report files only when --out is requested. |
| AI Coach (experimental) | A separate, optional package uses a redacted evidence packet and a configured model provider. | Provider-bound context leaves the device only after the user explicitly enables and confirms it. | Separate, opt-in, experimental, and not part of the default CLI. |
| Email feedback (current) | Your sender address, the message you choose to write, and any attachments you choose to add. | Cloudflare Email Routing forwards hello@firstrung.ai to the monitored Gmail inbox. | The email is kept only as long as needed to respond or review the feedback, or until you request deletion. |
| Structured pilot form (paused by default) | The structured rating packet plus its displayed request envelope: schema version, generated idempotency key, explicit consent and empty anti-bot field. | Only after explicit consent to the complete outbound packet. | When collection is enabled, a private Vercel Blob record in London (lhr1), deleted within 90 days; only a SHA-256 hash of the accountless deletion token is stored. |
| This website | A standard web request needed to serve the page. | The request reaches the hosting/CDN provider. | No FirstRung product analytics; hosting request logs may exist. |
Deterministic scan
Not included by default
Current scan feedback should be derived from limited local evidence, with uncertainty stated plainly. These materials are not sent to FirstRung by the CLI.
- raw code
- raw prompts
- raw diffs
- private logs
- environment values
- repository uploads
Different boundary
The AI Coach is not the scanner.
Provider-backed coaching cannot honestly be described as fully local. The experimental coach is available as a separate opt-in package and shows the exact outbound evidence packet before anything is sent.
The default firstrung install remains deterministic and Pi-free. Coach remains explicitly experimental and provider-backed; enabling it sends the disclosed context to the configured model provider.
UK privacy summary
Who controls pilot feedback
Bharathwaj Iyer operates FirstRung and is the controller for pilot feedback.
Contact: hello@firstrung.ai
The purpose is to evaluate and improve deterministic feedback. Sending a structured raw response or an email is voluntary and does not require an account. FirstRung does not use either for automated decisions or profiling.
Pilot collection is currently paused. When paused, the form remains inspectable but the server will not accept or store a new response.
Consent is the lawful basis for processing the raw response. You can withdraw it and erase that response with the Delete responsecontrol and private receipt, or by emailing the address above. For an accountless structured response, FirstRung may not be able to find it if you no longer have its receipt ID.
Email feedback includes your sender address, chosen message, and any attachments. Cloudflare Email Routing forwards it to a monitored Gmail inbox; no personal Gmail address is published. It is kept only as long as needed to respond or review the feedback, or until you request deletion. FirstRung relies on its legitimate interest in responding to and learning from voluntary email feedback. Do not email source code, secrets, credentials, private logs, or report files.
Your data rights and complaint route
Where applicable, you can request access, rectification, erasure, restriction, portability, or object to processing by email. You can also complain to the UK Information Commissioner's Office using its complaint service.
Before telemetry
Feedback should begin with consent.
The pilot form previews its complete packet, excludes project identifiers, requires explicit consent, and provides an accountless deletion credential. That credential is shown in the response only: it is not put in a URL, browser storage, analytics, or the stored record.
Email feedback is separate from that structured packet. It necessarily includes the sender address and whatever message or attachments the sender chooses to provide, so the data-minimised form promises do not apply to email.
Vercel provides hosting and processes the private Blob record for FirstRung. Raw feedback is stored in London (lhr1). FirstRung does not put an IP address, user agent, email address, repository, path, commit, report, or free text in that record. Vercel may separately handle ordinary request logs as part of hosting. Its dashboard runtime-log retention is one hour on the currently linked Hobby plan; this is separate from pilot-feedback consent. Raw records use a conservative 89-day expiry plus daily deletion, keeping physical retention below 90 days.
De-identified weekly grouped metrics may remain for up to 180 days after a raw record is deleted or expires. Groups with fewer than five responses are omitted; a group of exactly five can appear. Remaining metrics are grouped by surface/version, and by rule only when one was reliably supplied. They contain no receipt ID or deletion token, but FirstRung does not describe them as anonymous.
Review or submit the safe packetPrivacy or deletion contact: hello@firstrung.ai.