Fwozen is operated by Wavicon, which is the controller for the account data described here and the processor for the repository data your organisation puts into the service. For a DPA, mail [email protected].
What we collect
From GitHub, about your repositories: repository ids, names and visibility; branch names; pull request numbers and head commit SHAs; the GitHub logins of people who act in Fwozen; and the branch rules that determine whether a freeze would hold.
From you, as text you write: freeze reasons, exception reasons, schedule names, and organisation settings. These appear on pull requests, in Slack, and in your audit log, so don’t put secrets in them.
About your account: name, email address, and organisation membership. You sign in with GitHub, and Fwozen runs its own sign-in on fwozen.com — there is no identity provider in the middle, and no third party receives your account details.
Usage: anonymous page views and a small number of named product events (an install completed, a freeze created) through PostHog, with autocapture and session recording switched off. We do not send repository names to the analytics provider, and analytics stores nothing in your browser — no cookie, no localStorage.
What we never collect
Source code, diffs, commit messages, pull request titles or bodies, and committer email addresses. This is not a policy promise layered over a system that could do otherwise: incoming GitHub webhooks are projected at ingest, commits are reduced to SHAs, and those fields are dropped before anything is written to the database. There is a test over real GitHub payloads asserting the keys are absent.
Why we collect it
To operate the freeze engine — writing check runs to the right commits, verifying enforcement, running schedules in the right timezone — and to keep an audit log you can answer questions from six months later. There is no other purpose. We do not sell data, and we do not train models on it.
Who else processes it
Railway
Application hosting and Postgres, US region
seesEverything Fwozen stores
Stripe
Payments, invoices, tax
seesBilling contact, address, card token (Stripe holds the card, we never see it)
Slack
The Slack app and freeze notifications
seesWorkspace and channel ids, freeze reasons posted to your channel
GitHub
The product itself
seesRepository, branch, and pull request metadata; check run results
PostHog
Product analytics on explicit events, autocapture off
seesAnonymous usage events, org id, no repository names
Where it lives
Railway, United States region. Encrypted at rest, TLS in transit. Fwozen does not retain your GitHub access or refresh tokens at all: the identity callback uses one within a single request and drops it. The credentials it does hold — Slack bot tokens, its own API keys — are encrypted with a dedicated key and never logged. No production data on developer machines.
How much history you can see
Your plan sets how far back the freeze history and audit log are visible: 7 days on Free, 90 days on Team, unlimited on Business. This is a filter applied when the records are read. Older records are hidden from the app and the API, not deleted, and they reappear in full the moment you upgrade. We call it visible history rather than retention because retention normally means the opposite.
When it is actually deleted
Deleting your organisation in the app deletes its data, including the records the read filter was hiding. After a cancellation, private data is purged within 30 days; ask and we will do it sooner. Deletion happens in the live database. A database snapshot is a whole-database copy that nobody edits, so we do not restore one selectively to remove a record from it.
Your rights
Access, correction, export, and deletion — mail [email protected] and we will action it. Most of it you can do yourself in the app, which is faster than asking us.
Support access
If we need to look at your organisation to help you, the session is read-only and it is recorded in your own audit log. Nobody here can create or lift a freeze in your organisation.
Security
Details, including every GitHub permission we request and what it does not allow, are on the security page. Report a vulnerability to [email protected]; we acknowledge within 72 hours.
Cookies
One session cookie for the dashboard, and a localStorage entry remembering whether you chose the light or dark theme in it. The marketing pages you are reading now set nothing at all — they have one theme and no preference to store — until you sign in.