This policy covers Spyglass, the developer dashboard from Anchored Development LLC: the iPhone and iPad app, the Spyglass server it talks to, and its integrations. It starts with the Vercel integration. Our website has its own privacy policy.
Who We Are
Anchored Development LLC, Navarre, Florida, makes and runs Spyglass. Privacy questions and requests go to contact@anchoreddev.com.
The Vercel Integration
What it accesses, and why
With your consent at installation, Spyglass has read access to three things, and only for the account or team and the projects you chose:
- Integration configuration: the installation's ID, the account or team it belongs to, and which projects it can see, so Spyglass knows whose data it's reading and stays within it.
- Projects: project names, IDs, framework and linked Git repository, so a project can be matched to the repository you're reviewing.
- Deployments: each deployment's state, environment (preview or production), URL, the Git branch and commit it was built from, timestamps and, when you open one, its build output, so Spyglass can show the preview for the exact commit you're reviewing and what is in production.
It has no access to environment variables, secrets, domains, team members, billing or runtime logs, and no permission to change anything in Vercel.
Whether tokens and data are stored
Current development version. The integration is registered for development and
testing, and redirects to http://localhost:8977/callback, a callback on the developer's own
machine. In this version nothing from Vercel is stored on Spyglass's servers or in the Spyglass app.
Access tokens obtained during testing stay in that local test environment, are used only to test the
integration, and are never committed to source code or included in the app.
Public release. When the integration opens to the public, this policy will be updated before it does. As designed, it will store:
- the access token, encrypted, bound to your Spyglass account and installation;
- the installation and team IDs and the permissions you granted;
- a cache of the deployment details listed above, so the app loads quickly;
- alerts about failed or recovered deployments, and records of Vercel event deliveries to avoid duplicates.
Build output is fetched when you open it and isn't kept on our server.
Retention
- Access token and installation details: until you disconnect, uninstall, or delete your account.
- Cached deployment details: up to 30 days.
- Alerts: 30 days. Event delivery records: 7 days.
- An unfinished connection attempt: 10 minutes.
When you disconnect or uninstall
Disconnecting in Spyglass deletes the access token and everything cached for that installation, on our server and on your device, straight away. Uninstalling the integration on Vercel revokes the token; when Spyglass receives Vercel's notice, or at its next check (every 15 minutes), it deletes the installation's data. Removing a project's access deletes that project's cached data the same way. None of this changes anything in your Vercel account.
The Rest of Spyglass
GitHub
You sign in with GitHub so Spyglass can show your repositories, branches, pull requests and diffs, and make the commits, comments and merges you ask for. Your GitHub token is kept in your device's secure storage. If you also sign in with Apple to sync across devices, the GitHub grant is stored encrypted on our server so your other devices can use it. File contents you open are cached on your device; unsaved edits stay on your device until you commit them, and are deleted when you sign out.
Sign in with Apple and sync
Signing in with Apple links your Apple ID to your GitHub account so your settings follow you. We store Apple's identifier for you and your Spyglass settings; session tokens are stored only as one-way hashes.
Notifications and activity
To notify you about pull requests and CI, we store your device's push token and receive GitHub webhook events for repositories you watch. Notifications carry identifiers and short titles, never tokens or code. Activity events are kept 30 days, webhook deliveries 3 days, CI status up to 60 days, and an unused device registration 90 days.
Railway and Supabase
If you connect Railway or Supabase, their access grants are stored encrypted on our server. For Railway we keep metrics history (hourly for 35 days, daily for about 13 months), alerts for 30 days and a record of each action you confirm for 90 days. For Supabase we keep an audit of database reads and writes for 90 days, recording that a query ran but not its SQL or results, and a schema cache for 7 days. Disconnecting removes the grant.
AI suggestions
Optional AI features, such as suggested commit messages, send the relevant diff to Anthropic's API to generate the suggestion, only when you ask. We keep only usage counts, for 2 days, to apply limits.
Storage, Providers and Security
- Cloudflare runs the Spyglass server (Workers) and its database (D1).
- Expo delivers push notifications through Apple's push service.
- Anthropic generates AI suggestions you request.
- Apple provides Sign in with Apple and app distribution.
- GitHub, Vercel, Railway and Supabase are the services you connect; they hold your data under their own policies.
Stored provider tokens are encrypted with keys held as server secrets, never in the app or source code. Every request is checked against the signed-in user, so one person's data is never served to another. Tokens and code are kept out of server logs. Spyglass collects data only to work for you: it has no advertising, no analytics and no tracking, and we never sell data.
Deleting Your Data
Disconnect any integration in Settings at any time. To delete your Spyglass account and everything we hold for it, including all Vercel, Railway and Supabase data, email contact@anchoreddev.com. Anything not deleted earlier is pruned daily once it passes the periods above.
Children
Spyglass is a tool for software developers and isn't directed at children under 13.
Changes to This Policy
We'll update this page as Spyglass develops, with a new "Last updated" date, and tell you in the app or by email about significant changes, including before the Vercel integration's public release.
Contact
Anchored Development LLC, Navarre, Florida · contact@anchoreddev.com