Floka Docs
Permissions & data
Review the access Floka requests and how it handles GitHub activity before installing it for your team. You choose the repositories it can access; each developer connects their own Slack identity.
What access am I granting?
The GitHub App requests the following permissions. The installation screen shows the grants you are approving.
Scroll the table to see all columns.
| GitHub permission | Access | What the grant covers |
|---|---|---|
| Pull requests | Read & write | Read PR details and review activity. The current grant also permits changes to pull requests, although delivering notifications is a read workflow. |
| Contents | Read | Read repository contents. This is broader than PR metadata; notification delivery does not require cloning the repository. |
| Issues | Read | Read issue and PR conversation information, including comments on pull requests. |
| Metadata | Read | Read basic repository information used to identify repositories and their access. |
| Members | Read | Look up organization team members for team review requests and mentions. |
| Email addresses | Read | Read the account email information used with GitHub sign-in. |
GitHub sign-in identifies you and lets Floka check your repository access. The shared GitHub App installation receives the events used for notifications.
Scroll the table to see all columns.
| Slack scope | Access | Why Floka requests it |
|---|---|---|
| chat:write | Write | Send notification messages and update messages previously sent by Floka. |
| im:write | Write | Open the direct-message conversation used to deliver your notifications. |
| commands | Commands | Provide the /prbot command for connecting your GitHub identity and opening settings. |
Floka requests bot permissions, not Slack user scopes or channel/message-history scopes. Slack supplies the identity of the person authorizing the connection so Floka can link the accounts.
Can I restrict repository access?
Choose selected repositories when installing the GitHub App. An organization owner or other authorized administrator can change that selection through GitHub’s installed-app settings. Organization policies may require approval before access becomes active.
Share the administrator guide to request installation. Each developer then follows personal setup. Removing a repository from the installation changes access for everyone using that installation. Muting it in Floka settings only changes your own notifications.
What information passes through Floka?
| Information | Examples and purpose |
|---|---|
| Account and connection information | GitHub login, name, email, avatar, sign-in sessions, Slack user/workspace identifiers, installation access, and notification preferences. |
| Repository and PR information | Repository names and access, PR titles, authors, numbers, links, status, and change counts used to identify and render notifications. |
| Conversation and delivery information | GitHub webhook payloads, review/comment excerpts, participation, and records of sent Slack messages so they can be updated. |
Review and comment excerpts sent to Slack can contain code or other repository information. Consider both GitHub access and the destination Slack workspace when approving Floka.
Where does that information go?
GitHub → Floka on Cloudflare → your Slack DM. Floka receives GitHub events, determines the relevant recipients, and sends or updates their messages. Cloudflare Workers run the service and queues; Cloudflare D1 stores application records.
PostHog receives website and product analytics, including browser/device details, approximate location, page visits, referral/campaign information, setup and preference events, and notification delivery, resolution, and link-click events. Signed-in analytics are associated with a user ID, name, GitHub login, and Slack-link status.
Notification analytics include the repository name, PR number, and event category. Clicking a PR link in a Floka DM passes through Floka’s tracking redirect before opening GitHub. These clicks measure engagement; Floka does not know whether you read a DM without clicking.
If you contact support through Help, PostHog also handles the conversation. Floka supplies your authenticated support identity and setup diagnostics such as connection status, installation count, selected help topic, and notification preferences.
How are credentials protected?
Slack bot tokens and cached GitHub installation tokens are encrypted by Floka using AES-256-GCM before storage in D1. GitHub sign-in tokens are encrypted through the authentication library’s OAuth-token encryption. The server uses the relevant credentials to call GitHub and Slack.
GitHub and Slack event requests are checked using their signing secrets. Support identity is signed on the server from the authenticated session. These protections do not mean every application field is encrypted by the same mechanism.
What happens when I uninstall?
Removing the GitHub App revokes that installation’s access. Removing Floka from Slack revokes its ability to deliver messages there; Floka marks the connection unavailable when the revocation is detected. These are shared installations, so removal can affect other developers.
Uninstalling does not automatically delete all account, PR, notification, analytics, or support records, nor does it remove existing messages from Slack.
The scheduled cleanup removes webhook delivery records more than seven days old. It also clears stored payloads for successfully processed deliveries more than one day after processing. Other application records do not share that automatic expiry.
For questions about retained data or a deletion request, sign in to contact support. This page describes product behavior; the separate Privacy and Terms pages show the status of those documents.