How SceneBranch handles your code

• The repositories you choose, through the SceneBranch GitHub App. It asks GitHub for two permissions and nothing more: Contents: read and Metadata: read. No pushes, issues or settings. Each read uses a token that expires within the hour, and access to a repository ends the moment you remove it on GitHub.
• One commit, as text. A video reads the repository at one pinned commit, so the video and its history name the exact code. Only text files are kept (source, styles, copy, configuration), up to 12 MB, in memory: binaries, dependencies and build output are skipped unopened, nothing is written to disk, and nothing is ever executed.
• Your public website. The start page and up to 3 pages related to the feature, opened in a browser whose only way out is an egress proxy that reaches the public internet and nothing else. Your private network and internal services are out of its reach.

To show a feature, a model has to see it. For each video it gets the list of file paths, the files most relevant to the feature you asked about (at most about 240,000 characters, ranked by the feature’s words), the text and screenshots of the captured pages, and the script as it takes shape.

Every call goes through the providers’ business APIs, which don’t train models on API data. What each one keeps, with its own policy to check:

• OpenAI keeps API inputs and outputs, for abuse monitoring, for up to 30 days, and doesn’t train on it. Read the policy
• Google (Gemini API, paid tier) keeps prompts and responses, for abuse monitoring, for 55 days, and doesn’t train on it. Read the policy
• Anthropic keeps API inputs and outputs, under its commercial terms, for a limited period, and doesn’t train on it. Read the policy

With your own keys (Settings → Models and voices), calls run on your own account, and your own agreement with that provider applies.

• Source code: 14 days. The code a video read is deleted 14 days after that video (or the revision or update that read it) is made. Revising it later? SceneBranch reads the repository again at the same commit. If it can’t, because the repository was removed or disconnected, the revision stops, says why, and charges nothing.
• Videos, versions, facts and compositions: until you delete them. Facts are what a video says about your product (screens, labels, the flow), and compositions are the scenes it’s built from. They’re what lets a video be revised, or kept current when your product changes.
• Website captures (page text and screenshots) stay with the video they were made for.
• CI captures: 14 days, like source code. Each branch keeps its latest 5, and none is kept longer than 14 days, except the screens a video was made from, which stay as long as that video does. An upload that never finished is deleted within a day.
• Deleting a whole workspace: 7 days to change your mind. An owner deletes it from Settings → Workspace, and it stops at once: its videos stop playing where they’re embedded, its API keys and webhooks stop working, anything it was making stops, and its subscription is canceled. 7 days later everything in it is deleted for good, files included. Until then, support can restore it. Backups follow within a further 35 days, as the Privacy Policy says.

• SceneBranch never runs your code: no installs, no builds, no scripts on its side. With capture in CI, your own pipeline runs your app, against mocked data, and nothing else.
• SceneBranch never signs in to your app and never asks for its passwords.
• Nothing is ever written to your repository.
• Your content never trains AI models, and it’s never sold or used for advertising.

• Tenant isolation in the database. Row-level security is on for every table, so a query made for one workspace can’t reach another’s rows, even if application code got it wrong. The service refuses to start if any table is missing it.
• Encrypted secrets. Your AI provider keys and webhook signing secrets are encrypted with AES-256-GCM; API keys are stored only as one-way hashes.
• TLS everywhere, and encryption at rest with the hosting providers.
• Least privilege. Read-only access to your code, and SceneBranch’s own system access is limited to the jobs that need it and logged.

Some code shouldn’t leave the building. Capture in CI works the way visual-testing tools do: your CI builds your real frontend, runs it on its own machine against mocked data, and scenebranch capture uploads what it rendered. SceneBranch makes the video from that, and never sees the code that produced it.

• What is uploaded: the rendered pages (their markup, made inert, and their styles), the fonts and images they show, screenshots, the visible copy, the elements a demo can point at, design tokens (the CSS variables on the page) and the list of routes.
• What is never uploaded: source code, environment variables, secrets, real API responses, and the cookies or tokens of the mocked session. Every request your app makes is answered on the CI machine (your mocks, recordings or API spec, filled with demo data), so nothing else leaves it. A dry run (--dry-run) writes a report of every file and every request before anything is sent.
• Who appears: made-up people from your product’s cast (by default, Harvey Specter and the rest of Pearson Specter Litt), generated the same way on every run, so a video never shows a real customer.
• Checked on arrival: a capture token can upload captures for one product and do nothing else. Images and fonts must be what their bytes say, every page is sanitized again before any video uses it, and everything lands in your workspace’s own space.

• Amazon Web Services — Application hosting, media storage and transactional email (United States)
• Neon — Database hosting (United States)
• Vercel — Website hosting and delivery (Global edge network)
• Paddle — Payments, tax and invoicing (Merchant of Record) (United Kingdom / global)
• Anthropic, OpenAI and Google — AI models that plan and write your videos, when a generation uses them (United States)
• ElevenLabs — Premium AI voices, when you choose them (United States / European Union)
• Twilio — Phone calls and text messages (United States)
• Grafana Labs — Service health monitoring (no customer content) (United States)

The Privacy Policy covers the rest: what personal information is collected, why, and your rights.