MyRepo · Cityscape Enterprises LLC
Privacy and retention
MyRepo is a product of Cityscape Enterprises LLC. This public demo uses fictional repository activity and does not connect to your repository.
The categories below render from the generated V1 data inventory. It includes planned tables and fields as well as implemented ones; it describes the intended data contract, not a receipt that every integration or retention job is live. The inventory is technical documentation and has not had legal review.
Your account and workspace
What you and your workspace's admins typed or chose: membership, roles, settings, saved views and notification preferences.
Data and retention for your account and workspace
- Workspaces
- One row per workspace: the tenant that members, repositories and integrations hang on.
- Kept until the workspace is deleted. Deleting the workspace removes it.
- Members
- One row per person or agent in a workspace, with the role that decides what they may do.
- Kept while the person or agent is a member of the workspace. Removed when the member is removed or deletes their account.
- Invitations
- One row per pending invitation to join a workspace.
- Kept until it is used, revoked or expires, then purged within 30 days.
- Outbound webhook and relay endpoints
- Destinations a workspace admin configured for model events: an HTTPS URL, or a Slack or Telegram relay.
- Kept until the workspace is deleted. Deleting the workspace removes it.
- Environment mapping rules
- Workspace rules that map a provider's deploy to an environment.
- Kept until the workspace is deleted. Deleting the workspace removes it.
- Build-to-SHA rules
- Workspace patterns that extract a commit SHA from a store build number or version string.
- Kept until the workspace is deleted. Deleting the workspace removes it.
- Post-deploy probes
- Workspace-defined HTTP probes that move a change from live to verified.
- Kept until the workspace is deleted. Deleting the workspace removes it.
- Saved views
- Filters a member saved, synced across their devices.
- Kept while the person or agent is a member of the workspace. Removed when the member is removed or deletes their account.
- Actor resolution rules
- Workspace rules that decide whether a login, trailer, branch or label is a person, an agent or a bot.
- Kept until the workspace is deleted. Deleting the workspace removes it.
- Hot files
- Files a workspace declared conflict-prone, such as generated indexes and lockfiles.
- Kept until the workspace is deleted. Deleting the workspace removes it.
- Notifications
- What was sent to a member, and why.
- Kept for 90 days, then purged.
- Push destinations
- The push token or Web Push subscription of each device a member registered.
- Kept while the person or agent is a member of the workspace. Removed when the member is removed or deletes their account.
- Public status page settings
- Whether a workspace publishes a status page, and exactly what it may show. Off by default.
- Kept until the workspace is deleted. Deleting the workspace removes it.
- Check category rules · fields pending
- Workspace-editable mapping from check names to lint, typecheck, unit, e2e, build, security scan and policy.
- Kept until the workspace is deleted. Deleting the workspace removes it.
- Notification rules · fields pending
- A member's per-kind toggles, quiet hours and daily budget.
- Kept while the person or agent is a member of the workspace. Removed when the member is removed or deletes their account.
- Followed changes · fields pending
- Which changes a member chose to follow.
- Kept while the person or agent is a member of the workspace. Removed when the member is removed or deletes their account.
Repository activity
What the connected providers report about the repositories a workspace connected: pull requests, checks, runs, queue entries, deploys, tracker issues and the people, agents and bots doing the work. MyRepo receives it server to server through the GitHub App and the integrations a workspace owner connected. It is not collected from your device.
Data and retention for repository activity
- Connected repositories
- One row per repository a workspace connected through the GitHub App.
- Kept until the workspace is deleted. Deleting the workspace removes it.
- Raw provider events
- The append-only event store: one row per webhook delivery or poll result from GitHub and other connected providers, after secret redaction. Payloads contain pull request titles and bodies, branch names, commit messages, logins and, for some events, email addresses of commit authors.
- Kept for 90 days, then purged.
- Changes
- One row per pull request (or direct push): number, title, author login, branch, head SHA and the derived lifecycle stage and signal.
- Kept for 400 days, then purged.
- Checks
- One row per check attempt on a head SHA: name, attempt, conclusion and timings. Stored per attempt, never collapsed.
- Kept for 400 days, then purged.
- Workflow runs
- One row per CI workflow run attempt.
- Kept for 400 days, then purged.
- Workflow jobs
- One row per CI job: which runner labels it waited for and occupied, and for how long.
- Kept for 400 days, then purged.
- Merge queue entries
- One row per time a change entered the merge queue.
- Kept for 400 days, then purged.
- Deploys
- One row per attempt to put a SHA into an environment through a provider.
- Kept for 400 days, then purged.
- Sync log
- The ordered delta log clients and waiting agents read: one row per projected change to an entity.
- Kept for 30 days, then purged.
- Required checks
- Which check contexts a repository's rules require, read from branch protection and rulesets.
- Kept until the workspace is deleted. Deleting the workspace removes it.
- Runner pools
- Runner label sets seen in workflow_job events.
- Kept until the workspace is deleted. Deleting the workspace removes it.
- Flake ledger
- One row per check, head SHA and final attempt: first and final conclusion, so fail-then-pass is a recorded flake.
- Kept for 400 days, then purged.
- Merge groups
- One row per merge-queue group and how it ended.
- Kept for 400 days, then purged.
- Queue history
- One row per enqueue, grouping, ejection or merge of a change.
- Kept for 400 days, then purged.
- Environments
- Named places code runs, each with its live SHA. The only table an opted-in public status page reads from.
- Kept until the workspace is deleted. Deleting the workspace removes it.
- Ancestry cache
- Cached answers to 'does this deployed SHA contain that merge commit', so the question costs GitHub once.
- Kept for 400 days, then purged.
- Actors
- People, agents and bots seen working in a repository, resolved from logins, commit trailers, branch names and tracker labels.
- Kept until the workspace is deleted. Deleting the workspace removes it.
- Agent sessions
- One row per run of an actor on a host, kept alive by heartbeats.
- Kept for 90 days, then purged.
- Tracker issues
- Issues from a connected tracker (Linear, GitHub Issues) that changes claim to deliver.
- Kept until the workspace is deleted. Deleting the workspace removes it.
- Issue-to-change links
- Which change claims which issue, and where the claim was found.
- Kept until the workspace is deleted. Deleting the workspace removes it.
- Changed files
- The file paths each in-flight change touches, used to forecast conflicts.
- Kept for 90 days, then purged.
- Issue relations · fields pending
- Blocks and blocked-by edges between tracker issues, for the program view.
- Kept until the workspace is deleted. Deleting the workspace removes it.
- Assignments · fields pending
- MyRepo-side intent that a person assigned a ready issue to an actor. No tracker write, no agent launch.
- Kept for 400 days, then purged.
Credentials and secrets
Stored only as a hash, as ciphertext or as a reference to a vault entry. No credential is returned by any route or sent to any device.
Data and retention for credentials and secrets
- Paired runtime hosts
- Owner-paired unprivileged hosts, dedicated token digests and latest redacted process evidence; no environment, arguments or transcripts.
- Kept until the workspace is deleted. Deleting the workspace removes it.
- Workspace vault items
- Passwords, API keys and private notes saved by a workspace owner or admin for controlled human and agent use.
- Kept until the workspace is deleted. Deleting the workspace removes it.
- Agent vault grants
- One-use grants for one named agent to read one workspace vault item within fifteen minutes.
- Kept until the workspace is deleted. Deleting the workspace removes it.
- Invitations
- One row per pending invitation to join a workspace.
- Kept until it is used, revoked or expires, then purged within 30 days.
- Agent tokens
- One row per token minted for an agent member. The secret is shown once and only its SHA-256 digest is kept.
- Kept until the workspace is deleted. Deleting the workspace removes it.
- Outbound webhook and relay endpoints
- Destinations a workspace admin configured for model events: an HTTPS URL, or a Slack or Telegram relay.
- Kept until the workspace is deleted. Deleting the workspace removes it.
- Provider connections
- One row per connected provider (Vercel, Railway, App Store Connect, Play, Linear). Holds a reference to a workspace vault item, never the plaintext credential.
- Kept until the workspace is deleted. Deleting the workspace removes it.
- Push destinations
- The push token or Web Push subscription of each device a member registered.
- Kept while the person or agent is a member of the workspace. Removed when the member is removed or deletes their account.
Diagnostics
Operational data about MyRepo and about CI: request budgets, runner load, delivery logs, failure excerpts and optional host reports.
Data and retention for diagnostics
- Paired runtime hosts
- Owner-paired unprivileged hosts, dedicated token digests and latest redacted process evidence; no environment, arguments or transcripts.
- Kept until the workspace is deleted. Deleting the workspace removes it.
- Backfill progress
- Progress rows for the first import of a repository, which drive the onboarding progress bar.
- Kept for 90 days, then purged.
- Reconcile runs
- One row per scheduled reconcile: what drift it repaired and what it cost.
- Kept for 90 days, then purged.
- GitHub request budget
- The quota governor's view of each installation's remaining GitHub API budget.
- Kept for 30 days, then purged.
- Outbound delivery log
- One row per attempt to deliver an event to a workspace's endpoint.
- Kept for 30 days, then purged.
- Failure excerpts
- On request, the failing step, annotations and a bounded, redacted tail of a failing job's log. Logs are written by other people's CI and can contain anything; redaction is shape-based, so retention is short.
- Kept for 30 days, then purged.
- Runner load samples
- Windowed counts per runner pool used to compute saturation and an honest ETA.
- Kept for 90 days, then purged.
- Verification results
- One row per probe run against a deploy.
- Kept for 90 days, then purged.
- Generated log summaries
- Only for workspaces that opted in: a model-written summary of a redacted failure excerpt, cached by excerpt hash. It is labelled as generated and cannot change any status.
- Kept for 30 days, then purged.
- Log summary budget
- A per-workspace daily counter that caps model calls.
- Kept for 90 days, then purged.
- Host fitness reports
- Optional reports a small script posts from a machine that runs agents: load, memory, swap, disk and session count.
- Kept for 30 days, then purged.
- Daily metrics
- Daily rollups about the system (lead time, time in stage, deploy frequency, flake rate, runner use). Never per-person rankings.
- Kept until the workspace is deleted. Deleting the workspace removes it.
Billing
Which plan a workspace is on and the payment processor's ids for it. Card details never reach MyRepo.
Data and retention for billing
- Workspace plan
- Which plan a workspace is on and where that came from.
- Kept until the workspace is deleted. Deleting the workspace removes it.
- Billing customer
- The Stripe customer and subscription ids for a workspace. Card details never reach MyRepo.
- Kept until the workspace is deleted. Deleting the workspace removes it.
Audit log
An append-only record of sensitive actions, readable by a workspace's owners and admins.
Data and retention for audit log
- Runtime cleanup receipts
- Workspace-bound requests for owned idle sessions and actual host exit receipts. Completed rows older than 30 days are swept on that host's reports; offline history remains until workspace deletion.
- Kept until the workspace is deleted. Deleting the workspace removes it.
- Vault access log
- Workspace record of vault edits, secret reads and agent grant use; contains no secret values.
- Kept until the workspace is deleted. Deleting the workspace removes it.
- Guarded actions
- One row per requested guarded action (re-run failed jobs, update branch, enqueue, dequeue, dispatch a workflow) and its outcome.
- Kept until the workspace is deleted. Deleting the workspace removes it.
- Audit log
- Append-only record of sign-ins, role changes, token mint and revoke, integrations and every guarded action. Readable by owners and admins only. No role can update it; only a workspace purge deletes it.
- Kept until the workspace is deleted. Deleting the workspace removes it.
Account data outside MyRepo tables
Signing in to the development web app also uses the site’s authentication provider and session cookies; those are separate from the fictional public demo.
Deletion and questions
The V1 deletion contract removes your memberships, your agents and their tokens when an account is deleted, and removes workspace data when its owner deletes the workspace. The self-service deletion surface is still in development.
For a data request or privacy question, email support@myagency.dev. Do not include credentials in your message.