Last Updated: October 29, 2026
Scope of this Policy. This Policy describes how FYEO handles information collected through the FYEO website at fyeo.io (including our contact and inquiry forms and blog) and through the FYEO Scanner. It does not govern the performance of FYEO’s manual security audit engagements themselves, which, once engaged, are governed by a separately signed Master Services Agreement and its data-processing terms.
This Privacy Policy explains how FYEO, Inc., a Delaware corporation with a mailing address at P.O. Box 1708, North Conway, NH 03860 (“FYEO,” “we,” “us”), collects, uses, and shares information in connection with the FYEO website at fyeo.io, the FYEO Scanner, and related portal and APIs (collectively, the “Service”). It is incorporated into our Terms of Service. By using the Service, you agree to this Policy.
This Policy covers the FYEO website and the FYEO Scanner. The performance of manual security audit engagements is governed by the applicable signed Master Services Agreement and its data-processing terms, not by this Policy; however, information you submit through the website to inquire about audit or other services is covered by this Policy as described below.
Because we are a security company serving developers, our data practices are intentionally minimal. In short:
The sections below provide the detail behind this summary.
When you visit fyeo.io, read our blog, or submit a contact or inquiry form, we collect the information you provide and certain information about your visit. Through our contact and service-inquiry forms, we collect your name, email address, company or project name, the service you are interested in, an optional project URL or repository link, and the project details you choose to share (for example, codebase size, languages, timeline, and specific concerns). We use this to respond to your inquiry, schedule scoping calls, and provide the services you ask about. We also collect general browsing and analytics data as described in Section 2.4.
You sign in using GitHub. When you authorize the FYEO GitHub App, we receive your GitHub identity (such as your username and account identifier) and your email address through the GitHub email permission. If your GitHub email is a private “noreply” address, we may ask you to provide a deliverable email address so we can send you scan results and important notices.
Source code (ephemeral). To perform a scan, we access the repositories on which you have installed the FYEO GitHub App, or the public repositories you choose to scan, and clone the relevant code to temporary, ephemeral storage for the duration of the scan only. We delete our copy of your repository when the scan ends and do not store your repository in our databases. The findings, reports and threat models we keep can include excerpts of the code they refer to, such as the affected lines, file paths and function names, so that you can understand and fix each issue.
Findings and threat models (retained). We retain the security findings and threat models produced by your scans, associated with your account, so you can review them and track history and trends.
We may ask optional questions about you and your projects (for example, who you are building for, your primary blockchain or language, and team size) to understand our users and improve the Service. You may decline to answer. We also collect usage and log data generated as you use the Service, such as scan activity, device and browser information, and IP address.
Cookies and similar technologies. We use cookies and similar technologies in three categories: (1) essential cookies, required to operate the Service and keep you signed in, which cannot be disabled; (2) analytics cookies, which help us understand usage and improve the Service; and (3) marketing cookies, if any, used to measure and support promotional activity. Where required by law (including for users in the EU and UK under the ePrivacy Directive and PECR), we set non-essential (analytics and marketing) cookies only with your consent, and you can manage your preferences through our cookie controls or your browser settings.
When you purchase a paid subscription, our third-party payment processor collects and processes your payment details. We do not store full payment card numbers; we receive limited information such as billing status and the last digits of your card.
You can connect an AI assistant, such as Claude or ChatGPT, to your FYEO account through our MCP server at mcp.fyeo.io, or use our API with an API key. You approve each assistant on a FYEO consent page, and we keep that authorization until you disconnect it.
What we receive: the requests the assistant makes for you, such as which repository to price or which scan to read. We do not receive your conversation with the assistant.
What the assistant receives: the data it reads from FYEO, such as repository names, scan status, reports and findings, which can quote parts of your code. That data goes to the AI provider you use and is handled under that provider’s terms and privacy policy, not this Policy.
What the assistant can do: by default it can read your data, check your credit balance, redeem credit codes you give it and turn automatic PR scanning off. Only if you switch on “Let connected AI apps queue and cancel scans and turn on PR scanning” in your account settings can it queue scans (which reserves their quoted credits), cancel queued scans (which releases those credits) and turn PR scanning on (after which each eligible pull request scan uses credits).
Usage records: we record each request to the MCP server (which tool was called, whether it succeeded, how long it took, the size of the request and response, and your account identifier) to operate, secure and improve the Service. These records do not include the content of requests or responses.
Your choices: you can disconnect an assistant or revoke an API key at any time under Account → API access in the FYEO Scanner. Access stops immediately.
We use the information we collect to:
We never train on your source code. FYEO does not use your source code to train, fine-tune, or otherwise develop our models. As described above, your source code is processed ephemerally during a scan and is not retained.
Findings. We do not use your scan findings to train our models. We improve our detection models using findings drawn from FYEO’s own professional security audit engagements, used only in de-identified and aggregated form that is not attributable to any client or codebase.
FYEO infrastructure. Scanning is performed on FYEO-operated infrastructure.
We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We share information only as follows:
Marketing. Marketing emails are sent only with your separate opt-in consent. You can withdraw consent at any time using the unsubscribe link in those emails or in your account settings. Withdrawing marketing consent does not affect transactional messages necessary to provide the Service.
Access, correction, deletion. You may review and update your account information, and you may request access to, correction of, or deletion of your personal information by contacting us. Depending on where you live, you may have additional rights under laws such as the GDPR or the CCPA/CPRA, including rights to access, delete, correct, and port your data, and to object to or restrict certain processing. We will respond to verified requests within the timeframes required by applicable law (generally within 30–45 days, with extensions where permitted), will honor these rights as required by law, and will not discriminate against you for exercising them.
Exporting your data. You can export your findings and threat-model records from your account at any time through the export function in the portal, or by contacting us if you need assistance.
GitHub permissions. You control which repositories the FYEO GitHub App can access and can change or revoke the App’s access at any time from your GitHub settings.
Cookies. You can manage cookies through your browser settings; disabling some cookies may affect how the Service functions.
We keep the copy of your repository only for the duration of a scan. Findings, reports and threat models, including any code excerpts they contain, are kept like other account data, as described in this section. We retain findings, threat models, account, and usage information for as long as your account is active and as needed to provide the Service, and afterward as required to comply with legal obligations, resolve disputes, and enforce our agreements. You may request deletion as described above.
We keep the authorizations of connected assistants until you disconnect them, and MCP usage records for as long as needed to operate and secure the Service.
We use commercially reasonable technical and organizational measures to protect information, including encryption in transit and at rest where appropriate and access controls. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. In the event of a data breach affecting your personal information, we will notify affected users and regulators as and when required by applicable law, without undue delay.
FYEO is based in the United States, and we process and store information in the United States and other countries where we or our service providers operate. These countries may have data-protection laws different from those in your jurisdiction. For transfers of personal data from the European Economic Area, the United Kingdom, or Switzerland, we rely on appropriate safeguards under GDPR Chapter V, such as the European Commission’s Standard Contractual Clauses (and the UK Addendum where applicable) or an adequacy decision. Business customers who require a Data Processing Agreement incorporating these clauses may request one by contacting us at the address below.
The Service is not directed to anyone under 18, and we do not knowingly collect personal information from anyone under 18. If we learn we have collected such information, we will delete it.
We may update this Policy from time to time. The “Last updated” date and version above indicate when it was last revised. For material changes, we will provide reasonable notice. Your continued use of the Service after an update takes effect constitutes acceptance of the updated Policy.
Questions or requests regarding this Policy may be directed to FYEO, Inc., P.O. Box 1708, North Conway, NH 03860, or by email to hello@fyeo.io.