Legal

Privacy

Last updated 4 November 2026. This notice explains what Code Search (codesearch.amplfyd.com, part of amplfyd) stores when you use it, and why.

What we store

• Your GitHub user id, login, display name and avatar URL, so the dashboard can show who is signed in.
• The GitHub access token GitHub gives us when you sign in, encrypted with AES-256-GCM. It has no scopes, so it can only read public data. We use it only to run your searches and README reads on your own GitHub quota.
• SHA-256 hashes of your session cookie and your API keys, plus each key's name, first characters, creation date and when it was last used.
• Hourly counts of your API calls per key and endpoint (how many, and whether they succeeded, were rate-limited or came from cache), kept for 90 days for the Usage tab. Not the text of your searches.

What we do not store

• Your password. Sign-in happens on GitHub's own page.
• Your private repositories. The token cannot see them.
• A history of your searches tied to your account. Search results are cached for ten minutes, keyed by the search itself, so identical searches can be answered without calling GitHub.

Who else is involved

• GitHub, which handles sign-in and answers every search.
• Cloudflare, which hosts the site, the database and the cache.

Cookies

One sign-in cookie (HttpOnly, SameSite=Lax) and a short-lived cookie that protects the sign-in step. No advertising or analytics cookies.

Deleting your data

Delete your account from the dashboard under Account. Your keys, sessions and token are removed and Code Search's access to your GitHub account is revoked in the same step.