Where your code goes during a scan

Where the scan runs

On ReviewAhead’s server, not on your machine. There is no local tool, no command-line scanner and no agent running beside Xcode. You upload an archive over HTTPS, or point ReviewAhead at a repository it then downloads, and the parsing happens on the server that serves this page.

So the honest answer to “does my source code leave my machine” is yes, it does. What follows is the part that is worth checking: what happens to it once it is here, how briefly it stays, and what never goes anywhere else.

If you would rather not send source at all, scan a build instead. An .ipa, or a zipped .app, carries no source code, and the binary inside it is never extracted: ReviewAhead reads the shipped Info.plist, the privacy manifests, the embedded frameworks and the entitlements it was signed with. The report names the checks that therefore could not run, rather than passing them silently.

What happens to an upload, step by step

1. It is received. The archive is streamed to a temporary file of its own and validated before a single byte is extracted. A malformed, encrypted or oversized one is rejected right there.
2. It is extracted. Into an isolated directory created for this scan and nothing else.
3. It is read. 38 versioned rules read text files and a dependency graph. What a finding quotes back is at most 200 characters, and anything credential-shaped is masked before it is stored. Whole files are not stored.
4. It is deleted. The archive and the extracted directory are removed when the scan stops: the failure path and the cancelled path delete them exactly as the successful one does. Deleting the extracted files is the last step of the pipeline, and you watch it finish on screen.

A scan that stops to ask you something, such as which target to scan, keeps its extraction while it waits, so that answering continues that scan instead of unzipping and parsing everything a second time. Answering it or cancelling it deletes the extraction, and so does walking away: after about 30 minutes it is abandoned and deleted.

Those deletions run inside the scan, so they cannot run if the server itself stops halfway, for example during a restart. A cleanup that runs every few minutes removes anything a stopped scan left behind, normally within about fifteen minutes of the server being back.

Your code is read, never executed

There is no code path that compiles your project, runs a build phase or a script, installs a dependency, or contacts a URL found inside your files. Dependency manifests such as Package.swift and Podfile are parsed as text, never evaluated. No compiler, no simulator, no package manager.

What a connected repository exposes

Scanning from GitHub uses a GitHub App rather than an OAuth app, and the difference is the whole point. An OAuth repo scope is one checkbox that hands over every repository you can reach, including your employer’s. A GitHub App is installed on the repositories you pick, one by one, on GitHub’s own screen.

• It is granted read access to the contents and metadata of those repositories and nothing else. It never writes. No commits, no branches, no issues, no pull requests, no checks.
• It can see no repository you did not pick. Changing or removing that choice on GitHub takes the access with it immediately, without going through us.
• What is stored against your account is the installation’s numeric id, your numeric GitHub user id, the ids of the repositories GitHub says you can see in it, and when it last said so. None of them opens anything.
• The token from the connect round trip is used once, to check that the installation is really yours, and is then discarded. Every read after that runs on an installation token minted from a key held only on the server and valid for one hour. There is no standing credential of yours here to leak.

A repository you scan is downloaded as an archive and then handled exactly as an upload is: the same size ceiling, the same validation, the same isolated directory, and the same deletion when the scan ends. Bytes from GitHub are treated as bytes from a stranger.

Scanning a repository needs a signed-in account, because the installation has to belong to someone. Scanning an upload does not: that works without an account at all.

What is kept afterwards, and for how long

These are the same figures the Privacy Policy gives, which lists everything else that is kept, such as account and purchase records.

What leaves this server

• ReviewAhead does not train AI models on your project, and does not sell it.
• AI-assisted review is part of the unlimited plan and off until you switch it on for a scan. Switched on, Anthropic is sent permission purpose strings, finding titles, severities, explanations and evidence notes, the target name, the bundle identifier, the kinds of functionality detected and SDK names. Your project tree, your file contents and the evidence excerpts are not sent.
• On the unlimited plan you can connect a coding agent. It receives your reports when it asks for them; what it does with them after that is between you and its provider.
• Where you link an App Store Connect app, Apple is asked what Apple already holds about it. The request carries the app id and a signed token, and nothing from your project or your upload. Connect your own API key and the key itself never leaves your browser.
• Product analytics measures the pages and, if you allow it, whether a scan started and finished, never what is in a scan. On the scanner and the reports every piece of text is masked before it is recorded, recordings never include network requests or the browser console, and recordings are made only if you allow them.
• When something fails, an error report goes to Sentry: what failed and where in ReviewAhead’s code. Paths into your project, names from it and access tokens are stripped before the report is sent, and no recording of the page is attached.

What you can remove, and what goes anyway

• Deleting a project deletes it, every scan in its history, their settings and any paid copy of its reports, at once.
• Nothing waits on you to ask. A free report expires 24 hours after the scan that made it.
• An account is optional, so where you never made one there is nothing left to close.
• A report you paid for is kept longer because you bought it. Ask and it is removed sooner.

What this is not

ReviewAhead reduces submission risk. It cannot guarantee approval. App Review evaluates a running app, its content and its metadata, none of which a project scan can see. A clean report is not a prediction.

The Privacy Policy sets out the same ground as the document you can hold us to, including accounts, purchases and your rights over the data. The Terms of Service cover what you are agreeing to when you scan.