Privacy

Enforcement

This is a schema rule, not a promise

Every column on every hosted table is either a scalar type that cannot hold free text, or a column allowlisted one by one with a written reason. A check named assert_no_private_columns reads the live schema and fails if anything else appears. It runs in CI. If someone adds a hosted column that could carry source, a diff, or a key, the build breaks before it ships.

Hosted

What the hosted control plane stores

• Your GitHub account login, and the ids of repositories you connected.
• Job state for each review: which pull request, which commit, and whether it succeeded.
• Lifecycle events, flattened to identifiers, enum values, and token and cost totals. A database constraint rejects nested objects, so a findings list or a diff cannot be written here.
• Finding title, rationale, category and file path, so the dashboard can show you a review.
• The public text of replies people write on our review comments, used to build improvement candidates a human then reviews.
• Hashes: runner credentials, pairing codes, OAuth state, and notification webhook URLs. The originals are never stored.

Never hosted

What never reaches our servers

• Your source code.
• Your diffs.
• Your model provider API key.
• Retrieval chunks, evidence, and sandbox logs.
• Embeddings.

Local

What stays on your runner

• Your source and diffs, fetched with a short-lived GitHub installation token.
• Your model provider API key, in your operating system keychain, or a local file when no keychain exists.
• The local review cache and retrieval index.

Your runner sends your diff to whichever model provider you configured. That provider’s own terms apply to that call. We are not in the middle of it and we never see your key.

Cookies

One necessary cookie, and analytics only if you agree

We set one cookie, gh_live_sign_in, which keeps you signed in. It is strictly necessary. Without it the site cannot tell that it is you, so there is nothing to consent to.

Anonymous page-view analytics are separate and off until you accept them. Declining prevents the script from loading at all, rather than loading it and hiding the notice. Your answer is stored in your own browser. Clear your site data to be asked again.

Your data

Removing it

Uninstall the GitHub App to stop all new events. To have stored job metadata and finding text deleted, open an issue or use the contact route in SECURITY.md. Anything on your own runner is already yours to delete: reviewer uninstall removes it.