Privacy Policy

When you install the GrapeRoot Review GitHub App, we receive access to pull request metadata — file diffs, commit messages, and repository names — strictly to perform code review.

When you authenticate via GitHub OAuth, we store your GitHub user ID, username, and email address to associate reviews with your account.

We log webhook payloads from GitHub to diagnose delivery failures. Logs are retained for 30 days.

Code diffs are sent to the Anthropic API for AI analysis and are not stored beyond the duration of a single review job.

Your GitHub identity is used solely to gate access to your dashboard and to attribute reviews to your repositories.

We do not sell, rent, or share your data with third parties for marketing purposes.

GitHub — repository access and OAuth authentication.

Anthropic — large-language model inference for code review. Diffs are processed transiently; Anthropic's data retention policy applies.

Neon — PostgreSQL database hosting for review records and user accounts.

Railway — compute hosting for the backend service.

Review findings are stored until you uninstall the GitHub App or request deletion.

You may request full deletion of your data by emailing hello@graperoot.dev. We will action it within 14 days.

All data in transit is encrypted via TLS. Database connections use SSL. GitHub webhook payloads are verified using HMAC-SHA256 before processing.

Private keys and secrets are stored as environment variables and are never committed to source control.

We may update this policy as the product evolves. Material changes will be announced via the GitHub App listing. Continued use after changes constitutes acceptance.

Questions or deletion requests: hello@graperoot.dev