Privacy

Free Action

The Action reads only the two same-repository paths you configure after checkout. It executes no repository content, makes no telemetry call, and requests no token or secret input. It emits a bounded result to GitHub step outputs, the job summary, and the runner temporary directory, plus mismatch warnings and a concise state line in the job log. GitHub’s own platform processing is governed by GitHub’s policies.

Fit requests

The site stores a random record identifier, creation timestamp, constant site-source label, reply address, public owner/repository slug, pinned commit SHA, two repository-relative paths, your stated documentation goal, consent, and status. It does not intentionally persist source-file contents, credentials, IP addresses, tracking-cookie identifiers, private message bodies, or payment data. The Worker temporarily uses Cloudflare’s connecting-IP value as an in-memory rate-limit key for up to 10 minutes; that value is not returned or written to D1.

Purpose and retention

Fit-request data is used only to assess and answer the request, prevent abuse, and operate the bounded pilot. Declined or inactive inquiries are targeted for deletion within 90 days. Any future opt-in public evidence card will store only minimized result counts and identifiers and will expire after 30 days unless its owner explicitly renews it.

Infrastructure

The site is prepared for Cloudflare Pages, Workers, and D1. Cloudflare may process ordinary request metadata under its own policies. QuickstartProof does not add advertising pixels or cross-site analytics.

Your choices

You may ask to correct or delete a fit request by replying through the same address used for the request. Because no general contact mailbox is published yet, this process becomes available when an operator replies to the inquiry. The browser-only preflight sends nothing.