Privacy Policy

CodePanel reviews your pull requests with a panel of AI models. This page explains what we store, who sees it, and the choices you have.

When you sign in with GitHub we store:

• Your GitHub profile: username, name, avatar and email address if GitHub provides one.
• A GitHub access token, encrypted with AES-256-GCM. We use it to read pull requests and post review comments.

For repositories you connect we store:

• Repository metadata and pull request metadata.
• Diff patches, capped in size.
• AI review outputs, findings and chat messages.

If you subscribe or buy credits, we store your Stripe customer id, your subscription's status and your credit purchases and spending. Your card details stay with Stripe.

If you send feedback from the feedback page, we store your message, the email address you give (if any) and, when you are signed in, your account. We use it only to read and reply.

You can add your own API keys for the AI providers you want to use. We store them encrypted with AES-256-GCM and never show them back to you, and you pay those providers directly for calls on them. Calls you pay for with credits run on CodePanel's own provider accounts instead.

To run a review, pull request code and diffs are sent to the AI providers on your panel: with your own key, or with CodePanel's key when you pay with credits. That can include Anthropic, OpenAI, Google, DeepSeek, Groq, or a custom OpenAI-compatible endpoint you set up. What those providers do with the data is governed by their own terms and data policies, not ours. Choose providers whose terms fit the code you connect.

If you connect CodePanel to an AI assistant such as Claude or ChatGPT, you approve it on CodePanel's consent page and choose what it may do. We store the connection and its tokens: access tokens expire after an hour and refresh tokens after 30 days. The assistant receives the results of the tools it calls, such as your reviews, findings and repository settings, and keeps them under its own provider's terms. We do not receive your conversations with the assistant, only the tool calls it makes. You can revoke the connection from the assistant or from your CodePanel settings at any time.

We keep your account, connected repositories, reviews, findings and chat messages while your account exists, so past reviews stay readable and the panel can learn from them. Raw GitHub webhook deliveries are deleted after 7 days. Expired sign-in and connector tokens are purged daily. When you delete your account (Settings, Account), we cancel your subscription, delete your Stripe customer, and delete your account and the data above, including your stored keys and tokens, within minutes, or within an hour if a review was still running. Payment records that tax and accounting law requires us to keep stay with Stripe and in our books for as long as that law says.

We support accounts and keep the service paid for through an admin console. It shows metadata only, with one exception below: your GitHub login, when you joined, your plan and its billing state (the subscription's status, top-ups, any refund or dispute on them, and why auto-reload stopped), your credits and spend, the names of your connected repositories, and how your review rounds went (pull request number, status, timing, cost, and the code for why one failed or was refused, never its message; a refusal's code is kept for 7 days). It never shows your code, diffs, review findings or chat. The exception is feedback: what you send through the site's feedback form (its topic, your message, the email address if you typed one, and the account you were signed in as, if any) is read by the operator in the console's inbox, so write nothing there you would not want us to read. Feedback sent while signed in is deleted with your account. Each change an operator makes, such as a comp, a credit adjustment, a budget, releasing a stuck review or marking feedback handled, is recorded with the reason they gave. When you delete your account, those records stay, with your account's id removed, because they are our record of what was done; the operator's reason stays with them.

• Convex, which hosts our database and backend.
• Cloudflare, which hosts the website.
• GitHub, for sign-in and for reading and commenting on pull requests.
• Stripe, which processes subscription and credit payments and sends their receipts. You enter payment details on Stripe's pages, and they never reach us.
• PostHog, for error tracking and to monitor the cost and speed of AI model calls. We send errors, basic diagnostics and, for each model call, the model, token counts, cost, duration, retries and which kind of key paid, tagged with internal ids for your account, the repository, the pull request, the review round and the call, and the trace id you passed when you triggered the review, if any. We never send your code, prompts or reviews, and we do not use session recording.

Our benchmark pages show, for each AI model, how often authors fixed its findings and how often they dismissed them as false positives, overall and per programming language. These are totals across the accounts that share them, counted daily from findings of the last 90 days, and never from findings created before 20 October 2026. A total is published only when it covers at least 200 findings (50 for one language) from at least 3 accounts, with no account giving more than half of what is left when any other account's findings are set aside, and it is rounded. It never names an account, repository, pull request or file, and never includes code or review text.

Our agent pages and model pages also show, for each coding agent that answers reviews (for example with /feedback --agent), how the findings it answered came out: the share fixed, dismissed and disputed, overall and per AI model that raised them. These come from the same findings and accounts, under the same rules, never from findings created before 20 October 2026. An agent's total needs at least 200 findings and one model under it at least 50, each from at least 3 accounts. Only agents we have a page for are counted, by that page's name, never by the label your agent sent.

Your account is included unless you turn it off, under Settings → Account or through the API (POST /api/v1/account/sharing). Turning it off removes your findings from both kinds of totals at the next daily refresh. Disconnected repositories are never counted.

We do not sell your personal data. The model and agent statistics above are the only figures we publish from your reviews, and only as totals.

You can disconnect any repository at any time, keep your findings out of the public model and agent statistics, and revoke the GitHub app or OAuth grant from your GitHub settings. To delete your account and data, use Delete account under Settings, Account, or email support@codepanel.ai.

Questions about this policy: support@codepanel.ai.