Privacy Policy

Last updated: March 8, 2026

Overview

SignalBox ("we", "our", "us") is a developer tool that monitors GitHub Actions, Vercel deployments, and Linear issues, delivering real-time push notifications and signal intelligence. This policy explains how we collect, use, and protect your information.

Information We Collect

Account Information

  • Email address — used for authentication and account identification
  • Display name — shown in the app interface
  • User ID — internal identifier for your account

Authentication Tokens

  • OAuth tokens for GitHub, Google, and Apple Sign-In — used solely to authenticate you and access the integrations you configure
  • GitHub personal access tokens — encrypted and stored to poll your GitHub Actions workflows on your behalf

Push Notification Tokens

  • Device push tokens (APNs for iOS, Web Push for browsers) — used exclusively to deliver notifications you have subscribed to

Integration Data

  • GitHub Actions run data — workflow names, statuses, branches, and run metadata
  • Vercel deployment data — project names, deployment statuses, and URLs
  • Linear issue data — issue titles, statuses, and assignees

How We Use Your Information

We use your information exclusively for app functionality:

  • Authenticating your identity and managing your account
  • Delivering push notifications for events you subscribe to
  • Displaying integration data (CI runs, deployments, issues) in the app
  • Generating signal intelligence reports from your configured sources

We do not use your information for advertising, marketing to third parties, analytics profiling, or any purpose beyond delivering the SignalBox service.

Data Storage and Security

  • Data is stored in Supabase (PostgreSQL) with row-level security (RLS) enforcing strict tenant isolation
  • GitHub tokens are encrypted at rest using AES-256-GCM before storage
  • All data transmission uses HTTPS/TLS encryption
  • Authentication uses Supabase Auth with PKCE flow

Data Sharing

We do not sell, rent, or share your personal information with third parties. Your data is only transmitted to:

  • Supabase — database and authentication provider
  • Apple Push Notification service (APNs) — to deliver iOS push notifications
  • GitHub, Vercel, Linear APIs — to fetch data for integrations you configure

Tracking and Analytics

SignalBox does not use any third-party tracking, analytics, or advertising SDKs. We do not track you across apps or websites.

Data Retention and Deletion

Your data is retained for as long as your account is active. You can permanently delete your account and associated data directly from the app in Profile > Account Management > Delete account. If you no longer have access to the app, contact support@signalbox.sh for assistance. Upon deletion:

  • Your account and profile information will be permanently removed
  • All stored tokens will be destroyed
  • Push notification subscriptions will be deregistered
  • Event and signal history will be deleted

Children's Privacy

SignalBox is not intended for use by children under 13. We do not knowingly collect information from children under 13.

Changes to This Policy

We may update this privacy policy from time to time. Changes will be posted on this page with an updated "Last updated" date.

Contact

If you have questions about this privacy policy or your data, contact us at support@signalbox.sh.