Permissions and data
What the Kampa GitHub App can reach in your repositories, what Kampa stores and where, what leaves Kampa and to whom, what deleting removes, and how sign-in works. Everything here describes what Kampa does today. Where something is not built yet, the page says "not yet".
What the GitHub App can reach
The app can reach only the repositories you grant it when you install it, on GitHub's install page. You can narrow that list, or remove the app, from GitHub at any time: your profile or organisation Settings, then Applications, then Installed GitHub Apps.
On those repositories it asks for:
- Contents: Read and write. To read your token folder and commit Kampa's files to a new branch.
- Pull requests: Read and write. To open the pull request, merge it on Auto-merge, and find Kampa's own older branches to delete.
It does not ask for Workflows. GitHub refuses any write under
.github/workflows/ from an app without it, and Kampa never writes anywhere
under .github/. It does read .github/workflows/, to tell you in the pull
request whether the Kampa check workflow is installed.
Per push, Kampa works in the one repository the project is connected to, and
inside it: the token folder, the files it writes beside it (listed on
Your repository), .github/workflows/, and its own
kampa/ branches and their pull requests.
The app authenticates with a short-lived token GitHub issues for the installation, about an hour. Kampa asks for one when it needs to talk to GitHub and keeps it in memory for that request only. It is never written to Kampa's database.
What Kampa stores
Kampa keeps one record per project in its database. Only Kampa's server reads or writes it; your browser never queries the database directly, and every request checks that the project belongs to the signed-in account. Since migration 011 the database itself enforces this: every table is closed to the key your browser holds, so Kampa's server is the only reader. A project that isn't yours answers exactly as one that doesn't exist.
Each project record holds:
- The design data: the name, the token files for every mode, the mode list, and the component documents.
- Settings: the rail, Block push on check failure, and the WCAG level.
- The GitHub connection: the installation id, when it was connected, the repository owner and name, the base branch, and the token folder.
- The commit Kampa last agreed with the repository on, so it can notice a change made on the base branch before it pushes.
- The manual token, only if you entered one under Manual token (advanced). It is stored as you entered it and used only on Kampa's server. It is never sent back to your browser: the app only learns whether one is set.
- A Figma file key field. No screen sets it today, so it is empty.
- Bookkeeping: the account the project belongs to, and when it was created and last saved.
Kampa does not store your repository's other files, its history, or the installation's short-lived tokens.
In your browser
Kampa's pages keep a few things in your browser's own storage: the theme, the editor's panel layout, which project you last opened, and, while a push waits for you to connect GitHub, the change note you wrote for it. Your tokens are not kept there.
What leaves Kampa, and to whom
Kampa runs on Vercel, and its database and sign-in run on Supabase. Those are where Kampa itself runs, not places it sends your data on to.
GitHub is the only place project data goes today: the repository you
connected, when you push. A push sends the token files, the generated files,
the component documents, .kampa/check.mjs and .kampa/README.md, and the
pull request's title and description, including your change note and the check
result.
The check in your CI runs from the copy of .kampa/check.mjs committed to your
repository. It reads files and prints; it makes no network request, so nothing
it reads reaches Kampa.
Kampa includes no analytics or advertising scripts.
A prompt feature exists in Kampa's code, behind a per-project setting that is off and has no screen. This page changes before any screen turns it on.
Disconnecting and deleting
- Disconnect, in the project's Settings, then GitHub, removes the installation id, the connection date and the commit Kampa last agreed with. The repository owner, name and base branch stay on the project. The app stays installed on GitHub; remove it there to revoke its access.
- Delete project, in the project's Settings, then General, deletes the project's record, with its tokens, components, settings and manual token, and the prompt-feature usage records for it. Nothing in your repository changes: files Kampa pushed, its branches and its pull requests stay.
- Removing the app on GitHub stops every Kampa project that uses that installation from reaching its repositories. Kampa keeps the projects.
Not yet: there is no screen to delete your Kampa account itself.
Signing in
You sign in to Kampa in one of three ways:
- An email link. Kampa's sign-in service (Supabase) emails you a link.
- A code from the same email, typed on the sign-in page. Use it when you open the email on another device.
- Continue with Google.
A sign-in with GitHub is not offered. Connecting GitHub is a separate step, done per project, and it doesn't sign you in.
Signing in sets a session cookie for Kampa's domain. It identifies your account, with your user id and email address, and is refreshed while you use Kampa. It holds no GitHub access. Every Kampa page except sign-in and these docs needs it. Sign out clears it.
While you connect GitHub, Kampa also sets two short-lived cookies, only sent to its own server: one that ties GitHub's return to the request you started (ten minutes), and, for Connect a repository, one that holds the new installation until the project is created (one hour).
What Kampa never does
- Writes under
.github/, or asks for the permission to. - Stores a GitHub token other than the manual one you enter.
- Sends project data anywhere other than your GitHub repository.
- Returns the manual token to a browser, or lets one account read another's project.