Security and privacy
What Docup reads, what it never reads, what leaves its servers, and how reader data is handled.
This page covers what Docup reads, what it never reads, what leaves its servers, and how reader data is handled.
Your repository#
- Read-only. Docup downloads files and compares commits. It does not push, branch, open pull requests or change anything in your repository.
- You choose the scope. With the GitHub App, Docup sees only the repositories you allow, and you can change that on GitHub at any time.
- A filter runs first. Before any file reaches the AI, Docup drops files and folders based on size, extension, and patterns. Your own ignore paths add to this. See AI guidance.
| Filter Rule | Limit / Behavior |
|---|---|
| Maximum file size | Drops files larger than 100,000 bytes (~100 KB) |
| Maximum files per run | Stops indexing after 1,500 files |
| Maximum total size | Stops reading once total content reaches 12,000,000 bytes (~12 MB) |
| Excluded directories | Drops folder names like .git, node_modules, vendor, dist, build, out, target, .next, .nuxt, .turbo, .cache, coverage, .venv, .vscode, bin, obj |
| Excluded file names | Drops lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, etc.), .DS_Store, .npmrc, credentials, and keys |
| Excluded extensions | Drops binary types (images, videos, archives, .wasm, .pdf, .sqlite) and certificates (.pem, .key, .p12, .crt) |
| Minified and empty files | Drops files ending in .min.js or .min.css, and files with 0 bytes |
| Content checks | Drops files with binary data (a null byte in the first 8,000 bytes) or containing a private key (-----BEGIN ... PRIVATE KEY-----) |
- What the AI sees. The AI that plans and writes pages receives the files that pass the filter, for the length of the run. The files themselves are not stored as part of your docs; only the pages written from them are.
Environment example files such as .env.example are read on purpose, because they document configuration. Do not put real secrets in them.
Your docs#
- Pages are private drafts until you publish. Previews are only available to signed-in members of your workspace.
- Published pages are public. That includes sites made from private repositories, so review pages before you publish.
- Unpublishing returns every page to a draft. Deleting a project removes the site, pages and runs.
GitHub webhooks#
Push notifications from GitHub are accepted only when they carry a valid signature made with a secret shared between GitHub and Docup. Each delivery is processed once, even if GitHub sends it again.
Product analytics#
When you use docup.dev or the dashboard, Docup collects usage data with PostHog to improve the service:
- No cookies. The anonymous visitor identifier lives in session storage and is deleted when you close your browser tab.
- Do Not Track. Docup honors Do Not Track (DNT) browser settings.
- No IP addresses. Product analytics does not store your IP address.
- No repository or doc content. Your source code, generated documentation, and Ask AI questions are never sent to product analytics.
- No dashboard session recording. Recordings of clicks and scrolls are captured only on public marketing and sign-in pages, with all keystrokes and inputs masked. Session recording is never active inside the dashboard or on published docs sites. Recordings are deleted after 30 days.
- Anonymized paths. Dashboard URLs are scrubbed to mask database IDs, project IDs, run IDs, and custom page paths before they are transmitted to analytics.
Your readers#
- Analytics use no cookies. IP addresses and user agents are not stored. Visitors are counted with a hash that changes every day, so a reader cannot be followed from one day to the next. For IPv6 visitors, the subnet is grouped into a
/64block. See Analytics. - Ask AI keeps the conversation in the reader's browser tab only. Questions are used to find an answer and are not stored by Docup.
- Abuse protection: Ask AI uses a bot check and per-visitor, per-site and global limits.
| Limit Type | Scope | Exact Limit |
|---|---|---|
| Burst limit | Per visitor (IP address or IPv6 /64 subnet) |
20 questions per minute |
| Daily visitor limit | Per visitor, per site | 15 questions per day |
| Daily site limit | Per site, across all visitors | 500 questions per day |
| Daily global limit | Across all sites | 5,000 questions per day |
See Ask AI.
Accounts#
You sign in with GitHub or Google. If both use the same email, they link to one account.
Questions#
If you find a security problem, contact Docup through the contact page on the main site.