Privacy Policy

When you install and authorize the CodeOwl GitHub App on your personal account or organization, we receive access only to the scopes you explicitly grant:

• GitHub Profile & Organization Data: GitHub user ID, username, installation ID, and linked organization names to authenticate and manage your plan.
• Pull Request Metadata: PR number, title, author, commit SHAs, source/target branch names, and repository identifiers.
• Code Diffs and Context: The unified diffs and modified files associated with opened or updated pull requests necessary to generate accurate review feedback.
• Billing Details: If you subscribe to paid plans, payments are processed via PCI-DSS compliant third-party payment gateways. CodeOwl does not store payment card numbers.

We respect your intellectual property. We uphold a strict no-training commitment:

Our AI backend connects to enterprise-tier LLM endpoints governed by enterprise zero-data-retention agreements where inputs are processed ephemerally and discarded immediately after inference.

CodeOwl operates on an ephemeral review lifecycle:

• Source Code: Repository files and diffs fetched for review are stored in memory or short-lived isolated execution workers only during active analysis. They are destroyed within minutes of review publication.
• Review Summaries & Metrics: We retain audit metadata (timestamp, PR ID, findings count, severity categorization, and status check verdicts) to power team metrics and analytics.
• Immediate Purge on Uninstall: If you uninstall CodeOwl from GitHub Settings, your webhook secrets and installation records are queued for immediate de-provisioning.

We enforce modern defense-in-depth security measures:

• Encryption in Transit: All communications between GitHub, CodeOwl servers, and AI model providers use TLS 1.3 encryption.
• Encryption at Rest: Application configuration, encrypted tokens, and operational metrics are stored using AES-256 encryption.
• Least Privilege Access: Access to infrastructure is restricted with multi-factor authentication (MFA) and granular role-based access control.

Regardless of your geographic location, CodeOwl extends international privacy rights to all developers:

• Right of Access: Request a complete export of the metadata and account records associated with your installation.
• Right to Erasure: Request permanent deletion of all stored logs, metrics, and associated user records at any time.
• Right to Restriction: Revoke repository access granularly at any moment via your GitHub repository settings.

CodeOwl is created and maintained by Neelesh Kurmi. If you have questions about this policy, security inquiries, or wish to exercise your data rights, please contact: