Hemm is an early-stage project operated by Derrick Tsorme under the name Hemm Docs, based in Ghana. Hemm Docs is not yet a registered company. For privacy questions, email hello@hemm.dev.
Who this policy covers
This policy describes information handled through Hemm’s website and early-access documentation service. When a team connects its repositories, that team controls the content it shares with Hemm. Any separate agreement with that team also applies.
Information we handle
- Account information: GitHub identity, account and installation identifiers, access permissions, and authentication information needed to sign you in.
- Connected content: repository metadata, pull-request changes, and documentation within the configured review scope.
- Review records: findings, suggested changes, your decisions, and operational records that help us run and troubleshoot reviews.
- Onboarding information: answers and team context you provide, documentation inventories, generated drafts, and publication records used to set up documentation for connected repositories.
- Messages and technical information: information you send us and request or security information processed when you use the service.
How we use it
We use this information to authenticate users, check repository access, identify documentation affected by code changes, generate suggestions and starter documentation, record review and publication decisions, respond to messages, and maintain the service.
AI and service providers
Hemm uses GitHub for authentication and repository access. For AI review, repository analysis, and document generation, Hemm sends relevant code changes, documentation, and onboarding context to OpenAI directly or, when configured, through OpenRouter to a selected model provider. Hemm sends AI requests with store: false to avoid saved Responses application state; this does not prevent temporary processing, provider logging, or abuse-monitoring retention. See OpenRouter’s privacy policy and OpenAI’s data controls for their retention terms. Hosting and network providers also process information needed to deliver and secure the service.
Only connect content you are authorised to share with these services. Provider processing and international transfers must be assessed for your team’s requirements before connecting sensitive content.
Joining the waitlist
When you join, we store your email address, signup date, and confirmation-email status so we can manage early access. Resend processes your email address and the messages we send. Joining asks us to send a confirmation and contact you about Hemm early access; it does not subscribe you to unrelated marketing.
We temporarily keep hashed network identifiers to limit automated signups. Rate-limit records expire within 24 hours and are cleared on subsequent requests. To leave the waitlist or request deletion, email hello@hemm.dev.
Cookies
The application uses session cookies to keep you signed in. It also uses short-lived security cookies to connect GitHub sign-in and App installation returns to the browser that started them. The sign-in cookie expires after 10 minutes and the installation-return cookie after one hour. Blocking these cookies may prevent sign-in or connection setup from working.
Storage and retention
Hemm stores account, installation, configuration, and review records in its application database. Backups may contain copies of those records. Disconnecting a GitHub installation prevents future authorised access; it does not by itself erase existing records, backups, or comments already posted to GitHub.
Retention depends on the information’s purpose: maintaining an active account, providing review history, investigating security issues, meeting legal obligations, or recovering from failures. After we verify a workspace deletion request and the requester’s authority, we remove that workspace’s information from the live service within 30 days, except records we must retain for a documented legal obligation. Deletion is request-based; disconnecting the GitHub App does not itself start this period.
Encrypted recovery backups are kept on an hourly, daily, and monthly schedule, with monthly copies retained for about one year. Deleted information may remain in those backups until the copies expire; maintenance failures can delay expiry. Our recovery procedure requires us to reapply completed deletion requests before a restored backup serves traffic. Information already posted to your GitHub repository or pull requests remains under your GitHub organization’s control.
Your choices and requests
You can manage the GitHub App’s repository access through GitHub. To ask about access, correction, deletion, or other rights available under the laws that apply to you, use our contact page. We may need to verify your identity and authority over a workspace before acting.
You can also raise a privacy concern with Ghana’s Data Protection Commission. Rights and obligations may differ depending on where you are based.
Changes to this policy
We will update this page when our practices change and provide additional notice where required.