Privacy Policy

Version 1.1, effective November 9, 2026.

Who we are

The Spillway Ops Usage Report GitHub App is operated by Optic Nerve AI, LLC, which also operates the product’s website at www.spillwayops.com, the site that publishes this statement. The app runs at copilot-usage.app.spillwayops.com and renders GitHub Copilot usage reports for organizations that install it.

This statement covers the app and the www.spillwayops.com website. The website is a static site: it offers no sign-in, keeps no database, and reads nothing from GitHub. Its processing is its hosting, the analytics container, and the signup form, each described under “Subprocessors and service providers” below. The opticnerve.ai website and its newsletter carry their own privacy policy at https://opticnerve.ai/privacy; that newsletter remains separate from the app and the website. This statement does not cover the Spillway Ops product itself, the credit spillway this website describes; the product’s privacy terms will be published separately. Both the app and the website carry an optional signup form, for product updates and design-partner interest; MailerLite processes what is submitted through it, as described below.

What the app reads

The app asks GitHub for exactly three permissions. All three are organization-level and all three are read-only. It requests no repository permission of any kind, so it cannot read code or Copilot prompt contents.

• GitHub Copilot Business (read): the organization’s Copilot seat and plan information.
• Organization Copilot metrics (read): the Copilot usage metrics GitHub computes for the organization.
• Administration (read): the organization permission GitHub requires for its billing and credit-ledger endpoints. The app holds it only because those endpoints demand it, and the read-only grant cannot change any organization setting.

Whose authorization every read uses

Report data is fetched from GitHub’s REST APIs with the signed-in viewer’s own user access token. The viewer’s GitHub role is the ceiling: the app can show a viewer nothing GitHub would not show that viewer directly. Installation tokens, the credentials GitHub issues to the app itself, serve installation lifecycle webhooks only. They never serve report reads.

What we store

Nothing server-side. The app has no database: no metric, ledger row, seat roster, or report is persisted by the app. In-memory caches expire within 15 minutes, and a restart loses nothing but those caches.

The signed-in viewer’s session lives only in an encrypted session cookie in the viewer’s own browser; the server keeps no copy. The cookie holds the viewer’s GitHub access and refresh tokens and their GitHub identity, encrypted. It is a persistent cookie with a 7-day sliding expiration: each visit extends it, and 7 days of inactivity ends it.

The app itself sets no cookie for signed-out browsing, sample reports included: the sample reports shown without signing in are built from synthetic data only. Rendering one involves no GitHub call and no sign-in. The first cookie the app itself sets is the sign-in state cookie (__Host-SpillwayOps.OAuthState), written when the viewer starts sign-in; the session cookie above follows when sign-in completes.

Beside that guarantee sit the third-party cookies. In production, the website’s pages and the app’s pages served to signed-out visitors, sample reports included, carry Google Tag Manager and may set Google’s analytics cookies (the _ga family) through it; the exact cookie names and lifetimes are Google’s, documented at https://policies.google.com/technologies/cookies. Google reCAPTCHA sets cookies of its own around the signup form: on the app its script loads only when someone opens the form, offered on signed-out pages and signed-in reports alike; on the website every page embeds the form, so reCAPTCHA’s script loads with the page, and which cookies it sets, and when, are Google’s, documented at the same address. A signed-in viewer’s app pages carry no analytics script, so they set no analytics cookie, and the website’s own code sets no cookie. These services are described under “Subprocessors and service providers” below.

What we log

• Webhook handling logs the delivery id, the event and action, and installation and account identifiers. It never logs payload bodies.
• Application telemetry (logs and traces) goes to Azure Log Analytics and is capped at 0.1 GB per day. Logs carry operational identifiers and no report contents: report data is not logged.
• Telemetry is retained for 30 days, the Log Analytics workspace default.
• The website emits no application telemetry of its own; its hosting and analytics are described under “Subprocessors and service providers”.

Personal data in reports

The report displays per-member Copilot usage figures exactly as GitHub reports them. Usernames tied to usage figures are personal data. They are shown only to a signed-in viewer whose own GitHub role authorizes the read, rendered transiently, and never stored by the app. Anything designed to leave the page, the share and copy outputs, identifies members by ordinal. No username leaves the page.

Subprocessors and service providers

• Microsoft Azure: app hosting in the United States. The app keeps no report data, which is never stored.
• GitHub, Inc.: the data source and the identity provider. All report data originates from GitHub and is governed by your agreement with GitHub.
• Google LLC: website hosting, Tag Manager, Analytics, and reCAPTCHA. Firebase Hosting serves the www.spillwayops.com website, so each request for a website page, the visitor’s IP address and user agent with it, is handled by Google’s infrastructure. In production, website pages and app pages served to signed-out visitors, sample reports included, carry Google Tag Manager, one shared container, and the Google Analytics it runs; a signed-in viewer’s app pages carry no analytics, so no organization-identifying page data reaches Google through analytics. Google reCAPTCHA protects the signup form: on the app its script loads only when someone opens the form, whether from a signed-out page or from a signed-in viewer’s report; on the website its script loads with every page, because each page embeds the form.
• MailerLite: the product signup form’s processor. The form is optional and appears on both surfaces. On the app, none of its scripts load until someone opens it, on a signed-out page or a signed-in report; opening it loads those scripts, Google reCAPTCHA included. On the website, every page embeds the form, so MailerLite’s form script loads with the page. On either surface, a form view is counted with MailerLite only when someone opens the form, and submitting it sends what was entered, the email address and the form’s answers, from the browser to MailerLite. The app’s copy of the form adds a tag naming the app as the source.

Your rights and how to reach us

The app keeps no database and stores no report, viewer, or session record, so there is no stored report data for it to produce, correct, or delete; a report exists only while an authorized viewer renders it, and the operational logs hold only the technical identifiers described above, for the retention period above. Requests about the underlying usage data belong with the organization that holds your membership and with GitHub, which stores it.

The website offers no account and keeps no visitor record of its own; what its host, its analytics, and the signup form’s processor receive is described above.

Questions about this statement, the app, or the website: support@opticnerve.ai.

Lawful basis

We rely on the following lawful bases.

• Report data. When the app renders a report, it processes the report’s data on behalf of the organization that installed it, and on that organization’s instructions. The organization determines its own lawful basis for that processing, typically its legitimate interest in administering the Copilot seats it pays for. We claim no basis of our own for report data.
• Sign-in. The sign-in state cookie and the session cookie rest on our legitimate interest in keeping a signed-in viewer signed in. Both are strictly necessary to deliver what the viewer asked for, so they need no consent.
• Telemetry and security logging. The app’s logs rest on our legitimate interest in operating and securing it: diagnosing faults and detecting abuse and errors. What they hold, and for how long, is described under “What we log”.
• The signup form. Signups rest on your consent, given when you submit the form and confirmed through a double opt-in email. MailerLite keeps the record of that opt-in. You can withdraw your consent at any time by writing to support@opticnerve.ai.
• Support email. When you write to support@opticnerve.ai, we use your message and your contact details to answer it, on our legitimate interest in responding to what you asked.

Analytics. Website pages, and app pages served to signed-out visitors, run Google Analytics from the moment they load, and it may set Google’s analytics cookies then. We use it to measure, in aggregate, how the website and the app are used. It runs without a consent prompt. To stop it, use Google’s opt-out browser add-on at https://tools.google.com/dlpage/gaoptout.

Children

Neither the app nor the website is directed at children. The app installs on a GitHub organization and reports to that organization’s authorized members.

Changes to this statement

We revise this statement when what the app or the website reads, stores, or logs changes, or when a subprocessor changes. Each revision carries its effective date, and the statement’s history is kept in version control.