Last updated: August 5, 2026
The CushLabs OS Dashboard ("the Service") is an internal operations tool that displays live GitHub repository analytics. This policy explains what data the Service accesses, how it is used, and how it is protected.
Two surfaces are public and require no sign-in: the landing page and the /demo page, which runs entirely on fabricated sample data. Visiting either one collects no personal data and reads nothing from GitHub. The error monitoring described in section 6 does run on them; everything else in this policy describes the signed-in dashboard.
When you authenticate via GitHub OAuth, the Service reads:
One feature writes back to GitHub. Editing a project's tags in the Links view commits the updated links.json file to this application's own repository, using your access token and attributed to your GitHub account.
This is the only write the Service performs. It is triggered by an explicit action in the interface and never happens in the background. The requested repo OAuth scope carries write access for this reason.
Four data routes — portfolio, tasks, business development, and registers — cache their responses on the server for two hours to avoid repeating GitHub API calls. Cached data therefore persists between page loads for up to that long. Adding ?refresh=true to a request bypasses the cache and fetches fresh data.
There is no database. The cache is Vercel's, holds only the computed API responses described above, expires on its own, and is cleared by every deployment.
Documents you drop into the Ideation view — PDF, Markdown, or plain text — are read entirely in your browser. Their contents are never uploaded, never reach the server, and are never cached.
The Service does not:
Outside the two-hour response cache described above, GitHub data is fetched at request time and exists only in memory for the duration of the server response.
The Service uses Sentry. It is the only third party that receives anything about you — the certificate lookups in section 7 send hostnames and nothing else. Three things are sent to Sentry:
Nothing is recorded on an ordinary, successful visit. Until August 2026 this was not true — 10% of all sessions were replayed and every request was traced. Because the dashboard renders revenue and client data, that meant recording the business in exchange for no diagnostic value, so it was switched off. Sentry is not used for advertising, engagement measurement, or profiling.
Sentry's handling of what it receives is governed by its own privacy policy.
The Infrastructure view checks whether each monitored site is up by requesting it from the server and timing the response. Those requests go to the monitored sites themselves — the operator's own properties, not third parties — and carry no information about you.
The same view reports how many days remain on each monitored site's TLS certificate. Reading a certificate expiry date requires a lookup the browser cannot perform, so the server asks one of two public APIs — first networkcalc.com, falling back to ssl-checker.io if the first does not answer.
What they receive is the hostname being checked and nothing else — no personal data, no session token, no repository content. The request is made server-to-server from Vercel, so your browser and your IP address are never exposed to either service. The hostnames themselves belong to public websites whose certificates are already public records.
The Service uses GitHub OAuth for authentication. Your GitHub access token is stored server-side in an encrypted JWT session cookie. The token is never exposed to client-side JavaScript, never logged, and never transmitted to any service other than the GitHub API.
OAuth scopes requested: read:user and repo.
Signing in sets three cookies, all of them first-party and all set by the authentication library. Over HTTPS they carry the __Secure- and __Host- prefixes shown here, which instruct the browser to refuse them over plain HTTP.
No tracking cookies, no analytics cookies, no third-party cookies. The public landing and demo pages set no cookies at all.
The Service stores one preference in your browser's local storage:
The Service is hosted on Vercel. Server-side functions execute in Vercel's infrastructure. Vercel's privacy practices are governed by their own privacy policy.
You can at any time:
For privacy-related questions, contact: info@cushlabs.ai