Privacy Policy

Overview

PR Review Buddy comes in two forms: a command line tool that analyses a pull request and opens a review workspace on your own machine, and a Chrome extension that reviews pull requests inside GitHub. They have different data paths, so this page describes them separately.

One thing is true of both. Your code, your diffs and your review notes never reach PR Review Buddy. Everything happens between your machine, GitHub, and the AI tool you already use.

What we never receive

None of the following is sent to, stored by, or readable by us, on either surface.

• Your source code, diffs, or repository contents
• Pull request titles, descriptions, comments, or review output
• Anything you type into an AI assistant inside the product
• Your AI provider API keys, or the credentials your coding agent uses
• Your browsing history
• Your name or email address

The CLI and the review workspace

There is no PR Review Buddy account, sign-in, or API key. The CLI uses credentials, just never ours: the three network relationships below are all yours. The only thing it ever sends us is the usage telemetry described further down, which is on by default and which one command turns off.

• Your git remote. The analysis runs in an isolated checkout pinned to a single commit, created from the repository you are already standing in.
• GitHub, through your own tooling. Pull request conversation is read by invoking the GitHub CLI (gh) that is already installed and already authenticated on your machine. We never see that token and never handle it.
• Your coding agent. The analysis is performed by a coding agent you have installed, one of Claude Code, Codex CLI or Gemini CLI, run as a local subprocess under its own account, its own billing and its own privacy terms. Your code goes to that agent's provider exactly as it would if you had run the agent yourself, and it does not pass through us.

Reviews are stored on your machine, in ~/.prreviewbuddy. The workspace is served by a local web server bound to 127.0.0.1, on port 7726 unless you choose another, so it is not reachable from your network, and each review link carries a token that the server checks before serving anything. Deleting the directory deletes the reviews.

Usage events

The CLI records non-identifying usage events, counts and timings such as how long an analysis took and which phases ran. They are appended to a plain text file at ~/.prreviewbuddy/events.jsonl. They carry a random identifier generated on your machine that is tied to nothing about you, and they contain no code, no file paths from your repository and no free text. You can read or delete that file at any time; it is yours.

A small subset of them is also sent to a server we run. From version 0.30.0 that is on by default, and prreviewbuddy config set telemetry-upload off stops it.

This is a change, and it is a change to a promise. Until 0.30.0 the CLI asked once, sent nothing until you said yes, and this page said that a transmission would be opt in rather than merely disclosed. That is no longer what happens, so the sentence is gone rather than quietly softened. What the opt-in default produced was not a small sample, it was a sample of the people willing to answer a question: one or two installations against hundreds of weekly downloads, which answers none of the four questions further down. The honest fix was to change the default and say so here.

Two things did not change with it. Nothing new is collected: the table below is the same eight fields it was before. And an installation that had already answered no still sends nothing, because the answer you gave outranks the new default. Every installation the new default actually changes, which means every installation that never answered, is told once in the terminal that telemetry is on and how to turn it off. An installation that already answered is not shown that notice, because nothing about it changed.

Exactly what is sent

Two events and eight fields: six that both carry, and two more on the second. This is the complete list, not a summary of one. The server rejects any field that is not on it, rather than accepting the request and discarding what it does not recognise, so this table describes what the endpoint will actually store.

That identifier is an installation, not a person. It is a UUID the CLI generated for itself, stored in ~/.prreviewbuddy/config.json. It is not a GitHub id, an email address, a repository name, or anything derived from your code. If you use a laptop, a desktop and a CI machine, we count three, and nothing joins them up.

Rows are deleted after 90 days. Not archived, not aggregated into something kept longer: deleted. Every question this data exists to answer is a weekly one, so 90 days is thirteen weeks and answers all of them, and keeping longer would buy a year-over-year view nobody has asked for at the price of holding the rest indefinitely. A job inside the application deletes them every day, on its own, so the period does not depend on you or anyone else continuing to use the tool: if nobody ever runs it again, the rows still go.

No IP address and no browser or client user agent is stored against these events. A server necessarily sees an address while handling a request, and ordinary infrastructure logs may hold one briefly, but neither is written to the table these events live in, and neither will be.

What is never sent

Your source code, diffs, prompts, questions, review findings, file paths, repository names, branch names and pull request titles. Also the numbers about them: how many files changed, how many lines, how many issues were found or how severe they were. Those exist in the local file on your machine, and being plain numbers does not make them ours to collect. They answer no question this exists to answer.

It exists to answer whether the product is used, whether reviews finish, how long they take, and which coding agents people run it with. Nothing on the list above is needed for any of that.

Turning it off

prreviewbuddy config set telemetry-upload off stops the transmission and leaves the local file alone. PRB_TELEMETRY=off in your environment stops both, immediately, without needing any file to exist. You can also set "telemetry": false or "telemetryUpload": false in ~/.prreviewbuddy/config.json by hand, and the Privacy section of the review workspace's Settings page has the same switch.

Off is remembered as a decision rather than as an absence, which is what let an existing no survive the change of default in 0.30.0, and what will let it survive the next one.

The Chrome extension: GitHub access

The extension reads pull requests using a GitHub personal access token that you create and paste in yourself. That token is held in your browser's own storage and is sent only to GitHub, to identify the token's owner and to read the pull requests you open. The extension does not transmit it to PR Review Buddy or to any KloLabs-operated service.

To revoke access, delete the token in your GitHub settings, remove it from the extension's options, or uninstall the extension.

The Chrome extension: how review data is handled, by workflow

The extension offers three ways to run a review, and each has a different data path. None of them route review content through us.

• Repo AI: generates a review methodology prompt only. Your code and diff never pass through the extension; the coding agent you run it with (Claude Code, Codex CLI, Gemini CLI, Aider, and so on) reads your repository directly, under whatever access and privacy terms that tool already operates under.
• Buddy AI: sends the PR diff and any repository context you have selected directly from your browser to the AI provider you have configured (OpenAI, Anthropic, Gemini, or an OpenAI-compatible endpoint such as Ollama, LM Studio, or another self-hosted or third-party gateway you supply the address for), using the API key you provided. This is a direct request from your browser to that provider, and PR Review Buddy does not see or relay this traffic. For an OpenAI-compatible endpoint, the extension requests browser permission to contact the specific address you enter before it can send any request there; that permission is scoped to the address you provide and can be revoked at any time from Chrome's extension settings.
• Chat AI: builds a review prompt and copies it to your clipboard. Nothing is transmitted automatically; the PR diff only leaves your device if and when you paste that prompt into a chat assistant yourself.

Local storage

The extension stores your GitHub credentials, any AI provider API key you add for Buddy AI, your saved reviews, and your preferences (review style, selected repository context, theme) locally in your browser using Chrome's storage API. This data stays on your device and is not readable by us. Uninstalling the extension removes it.

Third-party services

Depending on how you use PR Review Buddy, requests are made to GitHub, to whichever coding agent you have installed, and, if you use Buddy AI, to the AI provider you configured. Those services are governed by your agreement with them, not by this policy, including any endpoint you point the extension at yourself. Please review their privacy policies independently.

Removing your data

• CLI: delete ~/.prreviewbuddy, which removes every stored review, the local usage events file and your settings
• Extension: remove your GitHub token in the extension's options, then uninstall the extension, which clears its stored data

Contact

Questions about this policy, or about anything above that is not clear enough, go to [email protected] or the support page.