Privacy Policy

Effective date: May 27, 2026  ·  Last updated: May 27, 2026

PR Autopilot ("we", "our", or "us") is a GitHub App that automatically generates pull request descriptions. This policy explains what data we access, how we use it, and how we protect it.

1. Data We Access

When installed on a GitHub repository, PR Autopilot receives the following data via GitHub webhooks:

• Pull request metadata — PR number, title, source and target branch names, and whether the PR is a draft.
• File diffs (patches) — The code changes included in the pull request, up to 20,000 characters.
• Repository name and owner — Used to write the generated description back to the PR.

2. Data We Do Not Access or Store

• We do not store pull request diffs, code, or any repository content after the webhook request is processed.
• We do not access issues, code outside of PR diffs, private keys, secrets, or environment variables.
• We do not build profiles of users or repositories.
• We do not sell, share, or transfer data to third parties for advertising or analytics purposes.

3. How We Use Your Data

The diff and PR metadata are sent to Anthropic's Claude API (claude.ai) to generate a pull request description. The generated description is then written back to the PR on GitHub. No data is retained after this operation completes.

4. Third-Party Services

PR Autopilot uses the following third-party services:

• Anthropic Claude API — PR diffs are sent to Anthropic to generate descriptions. Anthropic's privacy policy is available at anthropic.com/privacy.
• Vercel — Our server infrastructure. Vercel's privacy policy is available at vercel.com/legal/privacy-policy.

5. Data Retention

We do not maintain a database. PR diffs and metadata are processed in-memory during each webhook invocation and are not written to any persistent storage. Vercel may retain function invocation logs (including console output) for a limited period as part of normal serverless infrastructure operation.

6. Security

All webhook payloads from GitHub are verified using HMAC-SHA256 signatures before processing. All communication between our server, GitHub, and Anthropic occurs over HTTPS.

7. GitHub App Permissions

PR Autopilot requests the minimum permissions necessary:

• Pull requests: Read and write — To read PR metadata and write the generated description.
• Metadata: Read-only — Required by GitHub for all Apps.
• Issues: Write — Used only to add the "pr-autopilot" label to processed PRs.

8. Changes to This Policy

We may update this policy from time to time. The effective date at the top of this page will reflect the most recent update. Continued use of PR Autopilot after changes are posted constitutes acceptance of the revised policy.

9. Contact

Questions about this privacy policy? Email us at dunncarlin@gmail.com.