Privacy & Security
Two different questions, two different answers: what this website collects, and what the Honest Cheetah products do with your project data.
This website
www.honestcheetah.com is a brochure. It has no sign-in and no accounts. It sets no cookies, loads no third-party analytics, advertising, or tracking scripts, and there is nothing here to follow you around the internet with.
It does keep a server-side request log, so we can see which pages people read. Each page view records the IP address, the page requested, the HTTP method and status, the browser's user-agent string, the referring URL, and a timestamp. That is ordinary web-server logging, not behavioural profiling — but an IP address can identify you, so we would rather say so plainly than hide it behind "we don't use analytics."
Signing in happens on app.honestcheetah.com, which is a separate application. Its full privacy and security statement is on this site, linked below.
The products
Honest Cheetah for GitHub
Your planning data stays in GitHub. Honest Cheetah reads it live with your own GitHub sign-in and writes to it only when you click. What it keeps on its own servers is what GitHub has no place for: test cases, test runs and results, the screenshots and recordings attached to them, and the metric history a forecast needs. Issue titles are kept alongside those records; issue content is fetched from GitHub on demand, never warehoused. Your GitHub token lives in your session cookie and is never written to the database. During an import from Azure DevOps, the work items being imported are held in a tenant-partitioned staging area until the import completes or is discarded; on completion the staging area is reduced to a map of which work item became which issue or test case, and nothing else is kept. Your Azure DevOps personal access token is held in the browser tab, sent as a request header, and never stored; the server log records a fingerprint of it, not the token. Everything is partitioned by GitHub organization in Azure Cosmos DB and Azure Blob Storage, encrypted at rest and in transit.
Full privacy & security doc →Honest Cheetah for Azure DevOps
Your data stays in Azure DevOps. The extension installs from the Visual Studio Marketplace and runs entirely inside your Azure DevOps environment. It reads work items through the OData Analytics and Work APIs using two read-only scopes — vso.work and vso.analytics. Nothing is sent to Honest Cheetah servers or any third party.
Authentication
Honest Cheetah does not create accounts, manage passwords, or handle authentication itself. It relies on GitHub and on Azure DevOps / Microsoft Entra ID:
- You sign in with credentials you already have.
- Your organization's MFA policies apply automatically.
- Existing role-based access controls are respected in full — you see only what you were already authorized to see.
- Honest Cheetah does not extend, override, or bypass any access control.
Encryption
All traffic uses HTTPS with TLS 1.2 or better. For Azure DevOps, no data leaves your environment, so there is no additional encryption layer to manage. For GitHub, stored data is encrypted at rest in Azure Cosmos DB and Azure Blob Storage; your GitHub token is held in an encrypted session cookie and never written to the database.
What we don't do
- No advertising networks, no cross-site tracking, no third-party analytics scripts — anywhere.
- No selling or sharing of your data.
- No training models on your project data. AI features call Anthropic's API, whose commercial terms exclude training on API inputs and outputs.
- No storing of your source code.
We do collect operational telemetry, which is a different thing — see below.
Logging & telemetry
Operational telemetry — is it up, is it fast, did it throw — is not the same as tracking people, but it is still data collection, so here is exactly what happens where.
This website
A request log per page view: IP address, URL, method, status, user-agent, referrer, timestamp. Azure Application Insights collects server-side performance and error telemetry. No cookies, no client-side scripts.
For GitHub
Uses Azure Application Insights for application performance and error telemetry — Microsoft's monitoring service — for diagnostics and reliability. Sign-in and token-refresh failures are logged server-side, and application logs include user and organization IDs and token fingerprints for troubleshooting, never tokens, issue content, or AI prompts. There are no webhooks; reads from GitHub are live. Logs live in Azure-managed infrastructure with access limited to authorized people.
For Azure DevOps
No telemetry or usage analytics are collected from your Azure DevOps environment. The extension runs inside your tenant and sends nothing out.
Questions
Privacy or security questions: support@honestcheetah.com.
Product feedback: feedback@honestcheetah.com.