Privacy Policy

This Privacy Policy describes how HSLA0001 Inc. ("Company," "we," "us") collects, uses, and handles your information when you use Rams products and services.

Our Products

Rams includes multiple products with different data collection practices:

• Rams GitHub App: Automated design reviews on pull requests via GitHub App integration
• Rams MCP: The hosted review engine, called from your AI coding agent
• Rams Skill: A markdown file (/rams command) for AI coding assistants
• rams.ai: Website, dashboard, and account management
• Rams CI Action: The same hosted engine, called from your CI pipeline with your workspace API key
• Public score pages: The free scorer at /scores, which publishes a design score for a public GitHub repository
• Gate: An early-access program you can request access to at /gate

Account & Authentication

When you create an account, we collect:

• Email address and profile information from Google or GitHub OAuth, whichever you sign in with
• Workspace name and settings

Authentication is handled via Google or GitHub OAuth through Supabase. We never see or store your Google or GitHub password.

We may use your email address to contact you about your account, product updates, important announcements, and onboarding, including reaching out if you started but did not complete signup or checkout. These messages may reference your account activity, such as which repositories were reviewed or how many reviews you have used.

Some of these are written by a person and sent by hand. Others are sent automatically at a set point in your account's life — a welcome, a nudge if you signed up but never installed the app, a note if you installed but have no reviews yet, your first score. Each automated account email is sent at most once per workspace, and every reply reaches a person.

Once per workspace — ever — we may ask a short product survey: how you would feel if you could no longer use Rams, and a few open questions. The ask arrives by whichever surface reaches you first (an email, a line in a review response, or the dashboard) and is never repeated. Your answers are stored with your workspace to guide what we build and are never shown publicly.

Email is delivered by Resend. We record which address we sent to, which message it was, and what happened to it (delivered, bounced, or reported as spam). A hard bounce or a spam complaint adds the address to a suppression list so we stop mailing it.

To stop non-essential emails, reply "unsubscribe" to any of them or email rams@rams.ai. We honor every request. Billing and account-critical messages may still be sent while your account is active.

Team Invites

If you invite a teammate to your workspace, we collect the email address you provide in order to send the invitation and track whether it was accepted. Invite emails are one-time; the link expires after 7 days. A pending invite (and its email address) is deleted when you revoke it, and accepted invites become part of your workspace's membership records. Workspace members share access to the workspace's repositories, reviews, and settings.

Payment Information

Payments are processed by Stripe. We do not store your credit card number or payment details. We store:

• Stripe customer ID and subscription ID (for managing your plan)
• Plan type and billing period
• Subscription status (active, canceling, canceled)
• Review packs: which pack you bought, when, and the credits it added to your workspace

Rams GitHub App

When you install the Rams GitHub App and open a pull request:

Sent to AI for analysis (not stored by us):

• Changed file contents from the pull request, sent to Anthropic Claude for review
• For visual reviews, up to six files that the changed files import directly (a theme or token file, for example), fetched so the component renders with your real design values. They are rendered, never reviewed, and never appear in a finding

Code is held in memory only during analysis and immediately discarded. We never store your source code. Code sent to Anthropic is processed per their Privacy Policy.

Stored in our database:

• Repository name, PR number, PR title, branch name
• Review results: design score, issue count, severity breakdown, and each finding's description with its flagged lines and suggested fix (short code excerpts, the same ones shown on your PR)
• Visual review artifacts: before/after screenshots of rendered components and the applied patch, stored in a private bucket and deleted automatically after 30 days
• Usage metrics: files reviewed, token usage, duration, cost
• GitHub installation details: account login, installation ID, repository list

The app also receives the GitHub events it is subscribed to: pull requests opened or updated on enabled repositories, installation changes, and pull request comments. Comments are checked for the @rams review trigger and are not stored.

Posted to your GitHub PR:

• Design review comments with inline code suggestions

We never store:

• Your source files — they are held in memory during analysis only. Only the excerpts inside findings persist, as described above
• Secrets, API keys, or credentials from your repository
• Git history or commit contents

Rams MCP

When your AI coding agent calls the Rams MCP with your API key:

• The files your agent submits are sent to Anthropic Claude for review, held in memory during analysis, and immediately discarded, the same flow as the GitHub App
• Review results are returned to your agent, not posted anywhere
• We store the review (score, findings with their excerpts and fixes, usage metrics) for your dashboard and quota
• If your agent passes a session label (the optional context field), we store a shortened version as that session's name in your dashboard. It stays inside your workspace and never appears on any public page
• We never store the submitted files
• MCP connections authenticate with a workspace-scoped API key, or via OAuth 2.1 when you add Rams from the Claude connector directory — you approve access on a Rams consent screen and can revoke it at any time
• API keys are stored as a hash, never in plain text. We keep the key's name, its short prefix, and when it was last used
• We log each call's usage: which tool, how many files, tokens, duration, and the resulting score
• The CI Action uses the same API key and the same path: the files your pipeline submits are reviewed and discarded, and the review is stored against your workspace. We record that the call came from CI so the result can be attributed and metered

Rams Skill (/rams Command)

When you use the /rams command in your AI coding tool:

• We count downloads of rams.md, recording the request's browser user agent and where the link came from. No account or IP address is recorded
• The rams.md file runs entirely within your AI tool (Claude Code, Cursor, etc.)
• We have no access to your code, files, or AI responses
• No data is transmitted to our servers during usage

Public score pages (/scores)

The free scorer runs a review on a public GitHub repository and publishes the result at rams.ai/score/owner/repo. No account is needed. When you run one:

• The score page is public by design: the repository name, the score, the findings with their code excerpts, and the summary are visible to anyone with the link, and the repo is listed at /scores
• We store the IP address the request came from, to rate limit the scorer and stop abuse
• If you give an email address, we store it with the score, send you the link, and use it to rate limit per address. It is never shown on the public page
• Only public repositories can be scored. Files are analyzed the same way as any other review and are not stored

Want a score page taken down? Email rams@rams.ai and we will remove it.

Early access, sales, and business contacts

If you ask for early access to Gate, we store what you type in the form: your email address, and optionally your company, team size, the answers to the qualifying questions, and what you would want it to block. We also count visits to that page with the referring URL and the link's source parameter, so requests have a denominator. We store a one-way, salted fingerprint of the IP address the form was sent from — not the address itself — so the form can be rate limited. It cannot be read back as an address and is never used to identify you.

We keep a small sales record of companies and people we have spoken to or intend to contact: organization, website, contact name, work email, a public social handle, where the contact came from, and our own notes on the conversation. This is business contact information, gathered from public sources or from you directly, and it is used only to reach out and to keep track of the conversation. To be removed from it, email rams@rams.ai or reply to any message from us.

A request for early access, a Gate form submission, or a new subscription also sends an operational alert — which can include your email address — to a private Telegram channel that only we can read, so a person sees it quickly.

Analytics

We use Google Analytics to understand how visitors use rams.ai. Google Analytics collects:

• Page views, referral sources, and session duration
• Anonymized IP address, browser type, and device information

We also record, on your workspace, how you first arrived: the referring URL, the landing page, and any source, medium, or campaign parameters in the link. If you answer the "how did you hear about Rams?" question after signing up, we store that answer alongside it. This tells us which channels work; it is not used to profile you.

We also collect aggregate review statistics (total reviews, average scores) and performance metrics (review duration, error rates) for internal monitoring.

Cookies

Rams sets two kinds of cookies. Necessary cookies keep you logged in — the site does not work without them. Analytics cookies belong to Google Analytics, described above, and are the only optional ones. You can turn analytics off anytime via the "Cookies" link in the footer of every page; the choice takes effect immediately and is remembered in your browser. We set no advertising or cross-site tracking cookies.

Data Retention

• Account data: Retained while your account is active
• Review metadata: Retained for your dashboard and billing
• Source files: Not retained (discarded immediately after analysis; findings keep their short excerpts)
• Visual review screenshots and patches: Deleted automatically after 30 days
• Payment data: Managed by Stripe per their retention policies
• Public score pages: Retained until you ask us to remove one
• Email records: What we sent and what happened to it, retained while your account is active. Suppressed addresses are kept indefinitely, because that is what stops us mailing them again
• Early access requests and sales records: Retained until the conversation is closed or you ask us to delete them
• Product survey answers: Retained with your workspace while your account is active. Asked once per workspace, ever
• Visual review telemetry: For each visual decision we keep the outcome (shipped, withheld, and why), the workspace, and the repository and pull request it belonged to. No code and no images. Retained for internal monitoring
• Cached reviews: A review may be cached against a hash of the files that produced it, so identical code re-reviewed on the same engine version returns the identical result. The cache holds the review, never your files, and is dropped whenever the engine changes

Data Security

All data is encrypted in transit (TLS) and at rest. Our infrastructure:

• Vercel (website): SOC 2 Type 2 certified
• Supabase (database and file storage): SOC 2 Type 2 certified
• Railway (worker): SOC 2 Type 2 certified
• Anthropic (AI analysis): SOC 2 Type 2 certified; under Anthropic's commercial API terms, your content is not used to train models
• GitHub (app integration): SOC 2 Type 2 certified
• Stripe (payments): PCI Level 1 certified
• Resend (email delivery)
• Sentry (error tracking): SOC 2 Type 2 certified
• Google (analytics and sign-in)
• Telegram (operational alerts to a private channel)

See our Security page for details.

Your Rights

You have the right to:

• Request a copy of your data
• Request deletion of your account and data
• Cancel your subscription at any time
• Uninstall the GitHub App to stop all reviews
• Ask us to take down a public score page, or to delete you from our sales records
• Stop non-essential email by replying "unsubscribe" to any message

To exercise these rights, email rams@rams.ai.

Children's Privacy

We do not knowingly collect information from children under 13. If you believe we have collected information from a child under 13, please contact us and we will delete it promptly.

Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated effective date. Your continued use of Rams after changes constitutes acceptance of the updated policy.

Contact

Questions about this Privacy Policy? rams@rams.ai

HSLA0001 Inc.