Privacy Policy

Last updated: August 18, 2026

ActionLock ("ActionLock," "we," "us") is a GitHub App. This policy explains what data ActionLock collects when you install it on a GitHub organization or repository, how that data is used, and how to contact us about it.

1. What we collect

When you install ActionLock, GitHub sends us webhook events for the repositories you've authorized. From those events, we process:

• Installation metadata — which organizations and repositories have ActionLock installed, and the App permissions granted.
• Workflow file contents — the contents of .github/workflows/*.yml files, read at the time of a relevant push or pull request, in order to detect unpinned Actions and generate remediation pull requests.
• Repository and account identifiers — repository names, organization names, and GitHub user/installation IDs needed to open pull requests and status checks on your behalf.
• Plan and billing status — which pricing tier an organization is on, as reported by GitHub Marketplace webhook events. We do not receive or store payment card details; all payment processing is handled by GitHub.

We do not read, clone, or store any source code outside of the .github/workflows/ directory. Workflow file contents are processed to compute remediation diffs and are not retained longer than necessary to open the corresponding pull request.

2. What we don't collect

• We do not sell or rent your data to third parties.
• We do not use your repository contents to train machine learning models.
• We do not access repositories or organizations you have not explicitly installed the App on.

3. How we use data

Data is used exclusively to operate ActionLock: detecting unpinned GitHub Actions, resolving tags to commit SHAs via the GitHub API, opening remediation pull requests, running the ongoing-enforcement status check on paid plans, and providing support when you contact us.

4. Third parties

ActionLock's detection engine runs zizmor, an open-source static analyzer, as a local subprocess against your workflow files — no data is sent to a third-party analysis service. We use GitHub's own APIs to read workflow files and open pull requests. We use standard infrastructure providers (hosting, database) to run the service; those providers process data solely on our behalf and do not use it for their own purposes.

5. Data retention

We retain installation and repository metadata for as long as ActionLock remains installed on your organization or repository, plus a limited period afterward for support and abuse-prevention purposes. Workflow file contents processed during a scan are not stored beyond what's needed to open the resulting pull request. You can request deletion of retained metadata at any time — see Section 7.

6. Security

GitHub App credentials (private keys, webhook secrets) are stored as encrypted secrets, not in source control or logs. Access to production infrastructure is limited to the operator of ActionLock.

7. Your rights and choices

You can uninstall ActionLock from your GitHub organization or repository settings at any time, which stops all further data collection. To request access to, correction of, or deletion of data we hold about your installation, contact us as described below.

8. Changes to this policy

We may update this policy as ActionLock's features change. Material changes will be reflected by updating the "Last updated" date above.

9. Contact

Questions about this policy can be sent via Support.