Privacy

What CodeYinkx stores

• Your GitHub login and id, so the dashboard can identify you.
• Repository metadata and review results (findings, severities, statuses).
• Webhook delivery ids (to deduplicate), queues, and quota counters.

Installation access tokens are never persisted: they are held in memory and expire.

Third-party AI disclosure

When an administrator enables AI and a repository opts in, bounded excerpts of the changed files may be transmitted to the configured AI provider to produce suggestions. Only the minimum necessary content is sent, and secrets are redacted before sending.

We cannot verify that provider's retention or training policy. If you require confidentiality, leave AI disabled — static analysis needs no third-party service.

• AI is off by default.
• AI is off for private repositories unless the owner explicitly opts in.
• Full diffs are not stored by default.
• GitHub credentials and application secrets are never sent to the provider.