Privacy Notice

Who is responsible

The Data Fiduciary is Puneet Naliath, an individual (not a registered company). There is no registered company behind this project. This notice does not list an address, telephone number, or Data Protection Officer because none are used for this service.

Questions about processing, and every request to exercise your rights, go through the data-rights request form. That form is the published means of contact.

The service this processing enables

Dev Cleaner lets you sign in with GitHub to list and delete GitHub Actions artifacts, and connect a Vercel access token to list and delete Vercel deployments. Personal data is processed only to provide that service, to keep the sign-in session working, to record data-rights requests, and to operate the host securely.

Personal data collected and why

Itemised personal data and the specified purpose for each item:

GitHub account identifiers

After you consent and complete GitHub OAuth, GitHub returns your login, display name, account id, and any public email GitHub includes on the user profile. Purpose: show who is connected and call the GitHub API as you.

GitHub access token

Stored in an HTTP-only cookie on this site for up to 30 days. Purpose: keep you signed in so the app can list repositories and artifacts and delete the artifacts you select.

GitHub OAuth state value

Short-lived cookie (10 minutes). Purpose: prevent cross-site request forgery during sign-in.

Repository and artifact records you ask the app to load

Repository names, visibility, artifact names and ids, sizes, timestamps, and workflow branch or commit metadata. Purpose: display the cleanup lists and perform deletions you confirm.

Vercel access token

You paste it into the connect form. It stays in this browser's session storage until you disconnect or the tab session ends. It is sent to this app's server only to call Vercel's API. Purpose: authenticate you to Vercel.

Vercel account, team and project identifiers

Name, username, and email Vercel returns for the token, plus team, project and deployment ids, URLs, statuses, and git metadata on those deployments. Purpose: show who is connected and let you select and delete deployments.

Data-rights request contents

Full name, contact email, request type, description, optional account identifier, and nominee name and relationship when you nominate someone. Purpose: receive, identify, and handle your access, correction, erasure, grievance, nomination, or withdrawal request.

Consent and cookie choices

Whether you granted processing consent and whether you opted into optional analytics. Purpose: record and honour those choices.

Hosting and security logs

The host may record IP address, user agent, requested URL, and time. This app does not add its own analytics identifiers and does not write tokens or form contents to application logs. Purpose: deliver the site, detect abuse, and keep security logs.

Dev Cleaner does not ask for your address, phone number, payment details, or government identity numbers.

Cookies and trackers

Essential cookies are used for GitHub sign-in, the OAuth state check, and remembering consent and cookie settings. They are needed for the service you request.

Non-essential trackers are not loaded unless you opt in under Privacy settings. No third-party analytics, advertising, or social pixel is installed today. If optional analytics is enabled later, events are stripped of names, emails, tokens, and other personal identifiers, and tracking cookies are cleared when you withdraw that choice.

Reopen Privacy settings from the footer at any time. Withdrawing optional analytics clears known tracking identifiers from this browser.

Named processors

• GitHub, Inc. — GitHub OAuth sign-in and the GitHub API used to list repositories and list or delete Actions artifacts on your behalf.
• Vercel, Inc. — Hosting this application (request delivery and platform logs) and, when you connect a Vercel token, the Vercel API used to list teams, projects and deployments and to delete selected deployments on your behalf.

GitHub and Vercel process data on their own platforms under their terms with you as well as to carry out the API calls you start here.

Transfers outside India

GitHub and Vercel may process personal data on systems outside India, including in the United States. Transfers remain subject to any restriction the Central Government issues under section 16 of the Act and rule 15 of the DPDP Rules, 2025.

Children's data

Dev Cleaner is for people 18 years or older. A child is anyone under 18. The connect forms require you to confirm you are an adult before personal data is processed.

This service does not offer accounts to children, does not track or behaviourally monitor children, and does not target advertising at children. If it becomes known that personal data of a child was provided, that data is erased unless another law requires it to be kept. The app does not collect the identity documents that would be needed for verifiable parental consent, so it does not process children's data on that basis.

Retention

• GitHub access token cookie: up to 30 days, or until you disconnect or withdraw consent.
• GitHub OAuth state cookie: 10 minutes.
• Vercel token in session storage: until disconnect, withdrawal, or the browser session ends.
• Lists of repositories, artifacts, teams, projects and deployments: held in memory for the current page view and not stored as an account archive.
• Consent and cookie-preference cookies: up to 12 months, or until you change or withdraw them.
• Data-rights requests and associated processing logs: kept for at least one year from the date of processing, as required for security and government-information purposes under rules 6 and 8 of the DPDP Rules, 2025, then erased unless a longer legal retention applies.
• Platform hosting logs: retained by the host for its operations; this app does not keep a separate marketing profile.

Your rights

You may use the data-rights request form to:

• Access a summary of personal data being processed and the processing done with it, including processors it was shared with.
• Correction, completion and updating of inaccurate or incomplete personal data.
• Erasure of personal data that is no longer needed for the specified purpose, unless the law requires it to be kept.
• Grievance about how this service handled your personal data or your rights. A response is due within a reasonable period not exceeding 90 days.
• Nomination of one or more individuals who may exercise your rights if you die or become incapable of exercising them.
• Withdraw consent as easily as you gave it, using the same form, Privacy settings, or Disconnect. Withdrawal does not undo processing already completed lawfully.

Identify yourself on the form with the email you used in a request and, if you connected an account, your GitHub login or Vercel username. Each accepted request receives a reference ID you can look up on the same page.

How to give and withdraw consent

Connecting GitHub or Vercel, or sending a data-rights request, requires an unticked checkbox that you must actively select. The server rejects those actions without that consent. Consent is specific to the purpose stated next to the checkbox.

Withdraw processing consent from Privacy settings in the footer, by disconnecting the account, or by submitting a withdrawal request. Withdrawal clears the GitHub session cookie, asks this browser to drop the Vercel token, turns optional analytics off, and clears known tracking identifiers.

Complaint to the Data Protection Board of India

Exhaust the grievance process on the data-rights form first. You may then complain to the Data Protection Board of India, established by the Central Government under the Act. The Board is to function as a digital office. Use the complaint channel the Board or MeitY publishes. Official materials:

• Digital Personal Data Protection Act, 2023
• Digital Personal Data Protection Rules, 2025 (MeitY)

Personal data breach

If a personal data breach is discovered, each affected Data Principal is informed without delay, in clear language, with the nature, extent and timing of the breach, likely consequences, mitigation underway, steps you can take, and how to ask follow-up questions through the data-rights form. The Data Protection Board of India is informed without delay and with a detailed update within 72 hours, as required by rule 7 of the DPDP Rules, 2025.

Security

Access tokens are sent over HTTPS in production. The GitHub token is stored in an HTTP-only cookie. The Vercel token is kept in session storage on your device rather than in a server account database. API routes refuse to process account data without consent. This app does not log tokens or data-rights form contents to the console.