Data & privacy

InferFund stores nothing server-side

InferFund is fully stateless: there is no database. Your identity (numeric GitHub user ID, login, avatar URL) is carried inside signed, expiring access tokens after you authenticate with GitHub; it is not persisted by the service. OAuth client registrations are self-describing signed identifiers, and authorization codes are short-lived signed payloads — none of it is written to a store.

What becomes public

Everything you submit through contribution tools — attempt text, manifests, Lean sources, and your GitHub identity at submission time — becomes part of a public, append-only Git archive on the project repository. Merged history is intended to remain permanent. Do not submit secrets, personal data, or private conversation logs. InferFund never asks for and never stores hidden chain-of-thought; research artifacts are deliberate outputs.

What InferFund never does

• No GitHub repository-write permission is requested from you.
• Your GitHub OAuth token is used once (to read your identity) and never stored.
• AI-agent conversations are not collected.
• Bearer tokens are never logged or accepted in query strings.

Moderation & audit

Sensitive operations (logins, submissions, moderation actions) are emitted as structured, secret-free log entries. Moderation state (quarantine, restrictions) is itself public: it lives as append-only attestation files on the repository’s progress branch. Access tokens expire within an hour and can be invalidated for a user by public revocation attestations.