Privacy

OpenWings Automação Comercial Ltda. (CNPJ 63.852.648/0001-06), registered at Rua Padre João Wislinski, 441, Santa Cândida, Curitiba, PR, CEP 82630-494, Brazil, is the controller of the account, billing and operational data described on this page under Brazil's LGPD (Law 13.709/2018) and, where applicable, the GDPR. Its data protection officer (encarregado) is Gustavo Salomé Silva. For questions, access requests, corrections, portability or deletion, write to [email protected]. We answer within 15 days.

For the source code, packages and secrets that your workflows process inside a job machine, your organization is the controller and OpenWings Automação Comercial Ltda. acts only as processor while that job runs.

• Your account (app.users): when you sign in with GitHub, we receive and store your numeric GitHub user ID, login, name, email address and avatar URL, along with the language, time zone and email alert preference you choose in the dashboard. We never see or store your GitHub password.
• Your organization (app.accounts and app.memberships): the GitHub organization ID and login, avatar, GitHub App installation ID and status, repository selection mode (all or selected), each member's role (owner, admin or member), billing currency, credit balance, concurrency limit and low-balance alert threshold.
• Jobs and machines (app.jobs and app.runners): for each job that asks for a voar machine, we store the GitHub job ID and run ID, repository name (owner/name), workflow name, job name, runs-on labels, machine size, status, conclusion, queued, started and completed timestamps, billed units, cost, the GitHub job link, and the EC2 machine details (runner name, instance ID and type, availability zone, spot or on-demand market and any launch error).
• Billing (app.payments, app.ledger and app.usage_months): your Stripe customer ID, payment reference, checkout session ID, credit pack, amount, currency, balance ledger rows and monthly totals of free and paid units. Card details go directly to Stripe and never pass through voar.
• API keys (app.api_keys): the key name, 12-character prefix, SHA-256 hash of the key, read scopes, creator, creation date, revocation date and last-used timestamp. The full key (voar_...) is shown once when created and is never stored in plain text.

The voar GitHub App asks only for organization_self_hosted_runners (read and write), members (read), actions (read), metadata (read) and emails (read at sign-in). It has no permission to read your repositories' contents (contents), issues or pull requests, and voar's API and database never receive source code, job execution logs or workflow secrets.

Your workflow code and secrets go directly from GitHub to the job machine while the job runs (for example, in the actions/checkout step), just as on any self-hosted runner. Each job runs on its own EC2 virtual machine in São Paulo (AWS sa-east-1) with an encrypted root disk (gp3). When the job finishes, hits the 6-hour limit or sits 10 minutes without taking a job, the machine powers off and AWS terminates the instance and deletes its disk volume (DeleteOnTermination). No disk is ever reused by another job.

If your workflow uses actions/cache or Docker Buildx's gha cache, those files are stored in GitHub's own cache service under GitHub's retention rules, not on voar's servers.

When an organization owner or admin connects an AI app (such as Claude, ChatGPT, Codex or Cursor) to voar over OAuth 2.1 (https://app.voar.dev/oauth/authorize) or a terminal device code (https://app.voar.dev/device, client_id=voar-agent), voar issues a read-only API key bound to the chosen organization and the person who approved it.

• What the app can read: the key carries only three read permissions: account:read (GET /v1/account and MCP tool get_account), jobs:read (GET /v1/jobs and MCP tool list_jobs) and usage:read (GET /v1/usage and MCP tool get_usage). The app can read the organization summary, balance, free minutes, recent jobs list (repository, workflow, job name, label, machine size, status, conclusion, timestamps, billed units, cost, GitHub URL and why a job did not start) and daily usage for a month. It cannot read source code, job logs, workflow secrets or card details, and it cannot start or cancel jobs, change settings, buy credit or create keys.
• What voar receives from the AI app: only the tool name called, the query parameters sent (such as limit, before and month) and HTTP request metadata. We do not receive the rest of your conversation with the AI app.
• How to disconnect and revoke access: every connected app appears in the API keys table in your organization's Settings at https://app.voar.dev. Any owner or admin of the organization can rotate or revoke that key there at any time, which cuts off the app's access right away. Disconnecting inside the AI app alone does not necessarily revoke the key on voar.
• Checked on every call: every request to /v1 and /mcp checks in real time that the key is active, the GitHub App is still installed on the organization and the person who created the key is still an owner or admin of that organization. If they leave the organization or lose that role, the key stops working immediately.
• No model training: voar does not use your account data, job metadata or API and MCP calls to train AI models, and does not sell or share your data for advertising. Results already returned to the AI app you connected are governed by that app's own privacy policy.

• Job machines and disks: deleted immediately when the job finishes, after 10 minutes without a job or at the 6-hour job runtime limit.
• OAuth authorization and device codes (app.oauth_grants): stored only as SHA-256 hashes. Authorization codes expire in 5 minutes; device codes expire in 10 minutes. A daily task at 04:30 (America/Sao_Paulo) deletes expired rows. Dynamic OAuth client registrations (/oauth/register) are signed tokens and create no database row.
• GitHub webhook delivery IDs (app.github_deliveries): kept for 7 days to ignore duplicate deliveries, then deleted by the daily 04:30 (America/Sao_Paulo) cleanup task.
• Internal Redis queue jobs (BullMQ): completed jobs are kept for up to 24 hours (at most 200 records) and failed or dead-letter jobs for up to 7 days (at most 1,000 records). They hold internal row IDs and error messages, never repository code.
• API and sign-in access logs: Caddy logs for api.voar.dev and db.voar.dev redact the Authorization header and query-string secrets (code, state, token, token_hash, access_token, refresh_token, apikey) and are kept for 180 days (6 months, as required by article 15 of Brazil's Marco Civil da Internet, Law 12.965/2014).
• Database and queue backups: taken nightly, kept for 7 days on the server and for 30 days in Cloudflare R2 encrypted with age (with the private key kept off the servers), and deleted automatically after that window.
• Account, organization, job history, usage and API key records: kept while the account exists so you can view your dashboard history and key audit log. When you request account deletion at [email protected], we delete your account and organization records from the active database within 15 days (and they age out of encrypted backups within 30 days), keeping only payment and accounting records for the period required by Brazilian tax law.

We process account, organization, job, usage and sign-in data to provide the service you asked for (performance of a contract), access logs for 180 days and payment records to meet legal and tax obligations, and key hashes and anti-abuse controls under our legitimate interest in keeping the service secure.

We send transactional emails only to organization owners and admins who keep email alerts enabled on the Account page (when the balance drops below the configured threshold or runs out) and when there is a material change to these terms or the privacy notice. voar sends no marketing emails.

To run the service, we share only the necessary data with these processors:

• Amazon Web Services (AWS), in the São Paulo region (sa-east-1): runs the ephemeral virtual machines where your jobs execute.
• Oracle Cloud Infrastructure (OCI), in the São Paulo region: hosts the control plane (API, worker, Redis queue and Postgres database with GoTrue).
• Cloudflare: serves voar.dev and app.voar.dev, provides DNS and stores the nightly age-encrypted backups in Cloudflare R2.
• GitHub: authenticates your sign-in and sends installation and workflow_job events to the voar app.
• Stripe: processes credit pack payments and holds your payment method details, which never pass through voar.
• ZeptoMail (Zoho): delivers transactional balance alert emails.

Neither voar.dev nor app.voar.dev uses advertising, tracking or analytics cookies.

Your browser's localStorage stores only voar.locale (your chosen language), voar.theme (your light, dark or system theme preference) and, on app.voar.dev, the sign-in session token (sb-...-auth-token) that keeps you signed in until you sign out.

Under the LGPD and the GDPR, you have the right to confirm whether we process your data, access a copy, fix incomplete or outdated data, ask for anonymization or deletion, export your data in a portable format, learn which processors we share data with and object to processing based on legitimate interest. Write to [email protected] and we will reply within 15 days. You may also lodge a complaint with Brazil's National Data Protection Authority (ANPD) or your local data protection authority.