Legal
Privacy
How the website and hosted DoneState service collect, use, retain and delete data.
Effective date: 30 August 2026
Last updated: 16 October 2026
This notice covers the Proof & State website at proofandstate.com and the hosted DoneState service at donestate.proofandstate.com, including access through ChatGPT, compatible MCP clients and GitHub Marketplace. A locally operated copy of the open-source CLI is under its operator’s control and is not covered by the hosted-service processing described here. Other Proof & State hosted products may provide their own product notices.
Who is responsible for your data
The hosted service is operated by AYOBAMI JOHN HAASTRUP, a United Kingdom sole trader trading as Proof & State ("Proof & State", "we", "us"). Proof & State is the controller for account, Marketplace and service-operation data described in this notice.
Operating location: Northampton, Northamptonshire, UK.
For privacy requests, contact mailto:hello@proofandstate.com. For a confidential security report, contact mailto:security@proofandstate.com. Do not send passwords, API keys or unnecessary sensitive information in an email or public GitHub issue. We may request enough information to verify that a request relates to your account.
Website visits and correspondence
Cloudflare processes technical request information, such as IP address, user agent and security events, to serve and protect the website. We use this information only for operating and securing the website, on the basis of our legitimate interests. Hosting and security logs are retained under Cloudflare’s published retention schedules and the service settings in use; we do not promise UK-only processing.
With your permission, Google Analytics measures use of allowlisted public pages and fixed product actions for DoneState, OpsTruth and AgentProof. The website does not send prompts, repository content, form values, account identifiers or arbitrary URLs to Google Analytics. Browser Do Not Track and Global Privacy Control signals keep this optional measurement disabled, and you can change the choice through Analytics preferences on the site. Google Signals and advertising features are disabled, automatic enhanced measurement is disabled, and event/user retention is configured to two months.
Named AI crawler requests such as GPTBot, OAI-SearchBot, Claude and Perplexity are also counted server-side in Cloudflare Analytics Engine so we can understand machine discovery even when a crawler does not execute JavaScript. That crawler ledger stores only the crawler class, a coarse public product/page group, request method, response status and count. It does not store IP addresses, query strings, raw user-agent strings, prompts, account data or repository content.
If you email us, we process your address, message and relevant attachments to respond to your request. Correspondence is kept for the request and necessary follow-up, and deleted when it is no longer needed, subject to legal obligations or the establishment, exercise or defence of legal claims. Do not include credentials or unnecessary sensitive personal data.
Data we process and where it comes from
We process only data needed to provide, secure and evidence the service:
- GitHub and Marketplace identity: GitHub account ID, login, account type, authorising login, public profile fields, selected Marketplace plan and entitlement lifecycle. This comes from GitHub OAuth and the GitHub Marketplace API.
- Repository objective and authority: the authorised repository, base reference, objective, acceptance criteria, authority envelope, execution budget and repository selection that you submit.
- Credentials: an encrypted GitHub credential needed for an authorised repository objective and an OpenAI API key that you provide through the dedicated encrypted settings flow. Marketplace onboarding access tokens are not retained.
- Work and evidence: relevant authorised source code, diffs, validation output, branch and pull-request references, action results, verifier attestations and evidence references.
- Operational and security metadata: timestamps, delivery identifiers, state transitions, failures and bounded diagnostic records needed to operate, secure, deduplicate and audit the service.
- Aggregate product measurement: UTC day, a fixed funnel event name and an integer event count. These counters do not store GitHub login, account ID, repository, run ID, prompt/objective text, email, IP address, credential, plan identity or another customer identifier.
Data comes from you, GitHub, the selected authorised repository, OpenAI execution results and the independent verifier, such as OpsTruth. DoneState is not intended for special-category data, regulated workloads or secrets placed in objectives, source code or issue reports. MCP tool inputs do not request API keys, passwords, one-time codes or full conversation histories. The client sends only the tool arguments and resources selected for the task. GitHub sign-in and execution-provider credential entry happen outside the conversation through designated authentication and HTTPS account settings flows. Never paste credentials into a ChatGPT message, objective, source file or support issue.
Why we process data
| Purpose | UK GDPR lawful basis |
|---|---|
| Create and maintain the Marketplace entitlement, authenticate you and provide the requested service | Necessary to perform our contract with you |
| Execute the explicit repository objective and produce the authorised branch, pull request and evidence | Necessary to perform our contract with you |
| Secure the service, prevent abuse, deduplicate external effects, investigate failures and maintain an evidence trail | Our legitimate interests in operating a safe, reliable and accountable service |
| Measure aggregate service-stage usage so we can understand whether the owned service is usable and where workflows stop | Our legitimate interests in improving the service with data minimisation |
| Respond to support, privacy and security requests | Contract performance and our legitimate interests in supporting the service |
| Meet legal, regulatory or court requirements | Compliance with a legal obligation |
We do not sell personal data, use GitHub personal data for third-party advertising, or use it for unrelated marketing. The authenticated DoneState service funnel continues to use its own aggregate counters rather than Google Analytics and does not create a user-level analytics profile from those counters. Optional Google Analytics on the public website is kept separate from authenticated service/account data.
Providers and disclosures
We disclose the minimum necessary data to:
- Cloudflare, for hosting, storage, networking and isolated sandbox execution;
- GitHub, for identity, Marketplace entitlement, authorised repository access, branches, checks and pull requests;
- OpenAI, using the API credential you provide, for the bounded coding execution you request;
- OpsTruth or another pinned independent verifier, for the bounded execution snapshot and evidence needed to assess the result; and
- professional advisers, regulators, courts or public authorities where disclosure is reasonably necessary and legally permitted or required.
Each provider also processes data under its own terms and privacy documentation. Marketplace entitlement does not itself select a repository, grant execution authority, start work, push code or open a pull request.
International processing
The service does not promise UK-only storage or processing. Cloudflare, GitHub, OpenAI and their subprocessors may process data in the United Kingdom, European Economic Area, United States and other countries in which they operate. Where UK data-protection law requires a transfer safeguard, we rely on the applicable provider agreement, adequacy regulation, the UK Extension to the EU-US Data Privacy Framework, or approved contractual safeguards such as the UK Addendum to the EU Standard Contractual Clauses. Copies of provider safeguards are available through the providers' published privacy and data-processing terms.
Retention and deletion
| Record | Retention rule |
|---|---|
| Marketplace OAuth state | Ten minutes; it is one-time and consumed or expires |
| Marketplace onboarding access token | Used to verify identity and the selected plan, then discarded |
| Marketplace entitlement record | Kept while needed to administer the entitlement, handle cancellation and prevent duplicate events; deleted when no longer required for those purposes |
| Encrypted GitHub objective credential | Kept for the active objective and deleted when the terminal or cancelled objective is deleted |
| Encrypted user-funded OpenAI credential | Kept until you replace or delete it, close the service relationship, or the hosted service is withdrawn |
| Objective, action and evidence record | Kept to provide durable recovery and accountability until you delete the terminal or cancelled objective or the service is withdrawn |
| Provider security and operational logs | Kept under the relevant provider's published retention schedule and our configured service settings |
| Aggregate daily funnel counters | Kept for up to 90 days; records contain only UTC day, fixed event name and count and cannot identify a customer or repository |
| Account-deletion generation fence | A minimal opaque keyed owner digest in the shared registry and a generation number in the per-user credential vault are retained while the hosted service uses deletion fencing. The shared fence does not store the plaintext GitHub login and contains no credential, repository, objective or content data. It exists only to prevent stale in-flight requests from recreating deleted account data. |
You can use delete_objective to delete a terminal or cancelled objective and delete_openai_credential to delete the stored execution credential. The authenticated DoneState account console lets you inspect credential status, selected repositories and indexed objectives, and request deletion of indexed account data. Active objectives must be cancelled before account deletion can proceed. If a deletion fails part-way through, new writes remain blocked so the same authenticated session can retry safely.
Account deletion removes indexed deletable objectives, the stored execution credential, selected repository state, maintenance findings and user Marketplace entitlement records. An organisation entitlement may remain while the deleting user’s authoriser identity is removed. A minimal opaque deletion marker remains to prevent an older request from recreating deleted data; it contains no plaintext GitHub login, credential, repository or objective content. Historical runs created before account indexing may need deletion by their known run ID or a privacy request.
Revoking GitHub access or cancelling a Marketplace plan does not itself delete DoneState records. GitHub branches, pull requests, commits and evidence already published to a repository remain under that repository’s access and retention controls; deleting a DoneState record does not erase GitHub history. If the GitHub data-processing relationship terminates, GitHub-supplied personal data is deleted within the period required by the GitHub Marketplace Developer Agreement unless law requires otherwise.
Security
Credentials are encrypted at rest with separate operator-managed AES-GCM keys. Setup links are short-lived and single-use. Credentials are scoped into isolated execution, removed after use where documented, and redacted from bounded output. Consequential operations require explicit authority, and the service cannot merge, deploy, release, modify environments or secrets, or mark its own work verified. No online service can guarantee absolute security.
Your choices and rights
You can decline to provide required identity, credential or objective data, but DoneState will then be unable to provide the corresponding service. You can cancel the Marketplace plan, revoke GitHub authorisation, delete eligible objectives and delete the stored OpenAI credential.
Depending on the circumstances, UK data-protection law gives you rights of access, correction, erasure, restriction, portability and objection.
You have the right to object to processing based on our legitimate interests. We will stop that processing unless we demonstrate compelling legitimate grounds or need it for legal claims.
Use the contact routes above to exercise a right. We may need to verify your identity. You may complain to the UK Information Commissioner's Office at https://ico.org.uk/make-a-complaint/data-protection-complaints/.
Automated processing
DoneState and the connected model automate code generation, validation orchestration and service-state classification. They do not make solely automated decisions intended to produce legal or similarly significant effects about an individual. Users retain control over repository selection, authority, review and merge decisions. A VERIFIED state reflects bounded evidence and a pinned verifier; it is not a guarantee of correctness, security or fitness for purpose.
Changes to this notice
We may update this notice when the service, providers or law changes. The current version and effective date remain published on this website. Material new uses of personal data will be brought to affected users' attention before they begin where required by law.