Effective date: October 25, 2026
Last updated: October 25, 2026
This SecretUndo Privacy Policy explains how StoryTimeAndConfessions (“StoryTimeAndConfessions,” “we,” “us,” or “our”) collects, uses, protects, and deletes information when you use SecretUndo. SecretUndo is a developer-security service designed to detect exposed credentials and help users investigate, rotate, revoke, and remediate them.
By accessing or using SecretUndo, you acknowledge the practices described in this Privacy Policy. If you do not agree with this policy, do not use SecretUndo.
1. Who operates SecretUndo
SecretUndo is operated by StoryTimeAndConfessions in India.
Privacy and support enquiries may be sent to [email protected].
2. Information we collect
2.1 Google account information
Google sign-in is required to create and access a SecretUndo account. When you sign in with Google, we may receive:
- Your Google account’s stable user identifier;
- Your email address;
- Your display name;
- Your profile image; and
- Whether Google has verified your email address.
SecretUndo requests only the basic authentication scopes needed to identify you: openid, email, and profile. SecretUndo does not request access to Gmail, Google Drive, Google Calendar, contacts, or other Google account content.
2.2 GitHub installation and repository information
If you connect a GitHub account or organization, SecretUndo may process information provided through the GitHub App, including:
- Your GitHub account or organization name and identifier;
- GitHub App installation identifiers and permissions;
- The repositories you authorize SecretUndo to access;
- Repository names, default branches, visibility and archive status;
- Commit, pull-request and webhook metadata;
- File paths, commit identifiers and branch names associated with detected incidents; and
- Information necessary to create remediation guidance or an authorized remediation pull request.
You control which repositories are made available to SecretUndo through GitHub’s installation settings. You may suspend or remove the GitHub App through GitHub.
2.3 Secret-detection information
SecretUndo is designed to minimize storage of exposed credentials. When a possible secret is detected, SecretUndo may process the credential long enough to identify its type, calculate a non-reversible fingerprint, assess validity where authorized, and produce remediation guidance.
SecretUndo is designed not to retain the complete plaintext value of a detected credential in its incident database. Stored incident data may include:
- A non-reversible fingerprint;
- A masked representation of the credential;
- The suspected provider and credential type;
- The repository, file path, branch and commit where it was found;
- Validity and severity assessments;
- Ownership and potential blast-radius information; and
- Remediation, rotation, revocation and verification status.
You should never intentionally submit production passwords, private keys, recovery codes, full access tokens or other sensitive credentials through support email or ordinary website forms.
2.4 Technical and security information
When you use SecretUndo, we may automatically process:
- Session identifiers and session-token hashes;
- IP-address hashes;
- Browser and user-agent information;
- Request identifiers, timestamps and diagnostic information;
- Authentication, installation and security events; and
- Records needed to detect duplicate or fraudulent webhook deliveries.
We use secure, HTTP-only cookies to maintain authenticated sessions. These cookies are necessary for account access and security; they are not advertising cookies.
2.5 Support communications
If you contact us, we process the information you provide, such as your email address, message, diagnostic details and any files you voluntarily send. Do not include live secrets in support communications.
3. How we use information
We use information to:
- Create, authenticate and protect your SecretUndo account;
- Connect authorized GitHub accounts, organizations and repositories;
- Detect, deduplicate, classify and prioritize possible credential exposure;
- Identify possible owners, affected environments and blast radius;
- Provide confirmation-gated rotation, revocation and cleanup workflows;
- Verify whether an old credential has been revoked;
- Create remediation guidance and authorized pull requests;
- Prevent fraud, abuse, unauthorized access and duplicate webhook processing;
- Maintain audit records and diagnose service failures;
- Respond to support, privacy and account-deletion requests; and
- Meet legal obligations and enforce the SecretUndo Terms and Conditions.
SecretUndo does not sell personal information. We do not use Google account information, GitHub repository information or detected-secret metadata for targeted advertising.
4. Automated actions and confirmation
Security remediation can affect live systems. SecretUndo is designed to require clear user confirmation before performing supported credential rotation, revocation, history-cleanup or repository-changing actions.
You remain responsible for reviewing the affected credential, repository, provider, environment and proposed action before confirming remediation.
5. When information is shared
We may share or transmit limited information to service providers only where necessary to operate SecretUndo, including:
- Google, for account authentication;
- GitHub, for GitHub App installation, repository access and authorized remediation operations;
- Cloudflare, for application hosting, database services, security, DNS and request processing;
- Hostinger, for hosting the public StoryTimeAndConfessions website and policy pages;
- Resend and Amazon SES, where transactional service email is enabled; and
- Credential providers selected and authorized by you when performing supported validation, rotation or revocation.
We may also disclose information if required by applicable law, a valid legal process, or where reasonably necessary to protect users, the public, StoryTimeAndConfessions or SecretUndo from fraud, abuse or security threats.
We do not authorize service providers to use SecretUndo information for their own advertising purposes.
6. Data retention
We retain information only for as long as reasonably necessary for the purposes described in this policy:
- Account and workspace information is retained while the account remains active;
- Expired or revoked session records may be retained for up to 30 days for security and abuse prevention;
- Webhook delivery metadata may be retained for up to 30 days to prevent duplicate processing and investigate failures;
- Security audit events may be retained for up to 180 days;
- Incident and remediation metadata is retained while the associated workspace remains active, unless deleted earlier; and
- Deletion records may retain a non-reversible email hash and minimal completion record where necessary to demonstrate that a request was completed.
Residual copies may remain in encrypted backups for up to 30 additional days before being overwritten. We may retain limited information longer where required by law, necessary to resolve a dispute, or needed to protect the service from fraud or abuse.
7. Data security
We use safeguards designed to protect SecretUndo information, including encrypted HTTPS connections, restricted provider permissions, hashed session tokens, secure cookies, confirmation-gated remediation and audit logging.
No online service can guarantee absolute security. You are responsible for protecting your Google and GitHub accounts, reviewing authorized installations, using appropriate repository permissions and promptly revoking any credential believed to be exposed.
8. International processing
SecretUndo relies on global infrastructure and service providers. Information may therefore be processed in India and in other countries where our providers operate. Those countries may have data-protection laws different from the laws where you live. We take reasonable steps to use providers and safeguards appropriate for the information being processed.
9. Your choices and rights
Subject to applicable law, you may request:
- Access to personal information associated with your account;
- Correction of inaccurate account information;
- Deletion of your SecretUndo account and associated information;
- Information about how your data is used; or
- Withdrawal of consent where processing relies on consent.
You may disconnect SecretUndo from GitHub through your GitHub App installation settings. You may also revoke Google account access through your Google Account permissions page.
For account deletion instructions, visit SecretUndo Account Deletion.
10. Account deletion
Authenticated users may request deletion through SecretUndo’s account settings when that feature is available, or by following the instructions on the account-deletion page.
We may require reasonable verification before processing a request. Deleting a SecretUndo account does not automatically delete repositories, commits, pull requests or audit records held independently by GitHub or other providers.
11. Children
SecretUndo is a professional developer-security service and is not intended for anyone under 18 years of age. We do not knowingly collect personal information from children through SecretUndo. If you believe a child has created an account, contact us so that we can investigate and take appropriate action.
12. Third-party services
Google, GitHub, Cloudflare, Hostinger, Resend, Amazon SES and supported credential providers operate under their own terms and privacy policies. This Privacy Policy does not control how those independent services process information.
13. Changes to this policy
We may update this Privacy Policy when SecretUndo’s features, providers, legal obligations or data practices change. The updated version will be posted on this page with a revised “Last updated” date. If a change materially affects how account information is used, we will provide additional notice where reasonably practical.
14. Contact us
For privacy questions, support requests or account-deletion enquiries, contact:
StoryTimeAndConfessions
India
Email: [email protected]
Related pages:
Follow Us On Social Media: