Trust
Where does your code go?
Last updated: 23 July 2026
Reviewsaur reads the diff of a pull request, turns it into a short comprehension quiz using an AI provider, discards the diff, and keeps only the quiz. This page explains exactly what we access, what leaves your infrastructure, what we store, and how you delete it. Every claim here describes how the product actually works — if you want to verify anything, email [email protected] and we’ll walk you through it.
1. The path your code takes
- Step 01A PR is openedGitHub sends us a webhook for the pull request. Nothing happens until then.
- Step 02We fetch the diffThe PR diff, title, description, and recent commit messages. Never a clone of your repository.
- Step 03A quiz is generatedThe filtered diff is sent to our AI provider once, to write the quiz questions.
- Step 04The diff is discardedThe raw diff is never written to our database. We keep the quiz, not your code.
In detail, when a quiz is generated we fetch from GitHub:
- the pull request’s unified diff and the list of changed files with their patches;
- the PR title and description;
- the last 10 commit messages on the branch, for context.
We never clone your repository, and files that a PR doesn’t touch are never fetched. Files matching your excluded paths are stripped from both the file list and the diff before anything else happens — an excluded file’s contents never reach the AI provider. Oversized PRs (more than 50 changed files or 300,000 characters of diff) are rejected before any AI call is made.
2. What is sent to the AI provider
To generate a quiz, we send our AI provider the PR title and description, the filtered diff, the changed file paths, and the recent commit messages. The name of your repository and organization is not included in the prompt. To grade a written answer, we send only the question, its grading rubric, and the answer — not the diff.
We do not use your code or quiz data to train our own models, and our AI provider processes requests through its commercial API, whose terms exclude API data from model training. The current provider is listed in the sub-processor table in our Privacy Policy, which is kept up to date as the single source of truth.
3. What we store — and what we never store
| We store | We never store |
|---|---|
| The generated quiz questions and explanations | The raw diff — it is discarded after generation |
| A short AI-generated summary of the PR | Full repository contents or unchanged files |
| Changed file paths and line counts (not file contents) | Your GitHub access tokens |
| Quiz answers, scores, and attempts, per reviewer | Card or payment details (handled by Stripe) |
| Account and team data (GitHub username, email, role) |
In practice this means we see less of your code than your CI provider does — and we keep none of it.
4. GitHub App permissions
The Reviewsaur GitHub App requests the minimum set of permissions it needs to do its job:
| Permission | Access | Why we need it |
|---|---|---|
| Pull requests | Read & write | Read PR metadata; post the quiz link as a comment |
| Checks | Read & write | Create and update the Reviewsaur Quiz status check |
| Contents | Read-only | Fetch the PR diff and recent commit messages |
| Metadata | Read-only | Basic repository information (required by GitHub) |
| Organization members | Read-only | Verify that a quiz taker belongs to your team |
Signing in to Reviewsaur uses GitHub OAuth with the user:email scope only, and we do not store the OAuth token.
5. Retention & deletion
The diff exists in our systems only for the moment of quiz generation. Quiz questions, PR summaries, and results are kept while the repository stays connected, so your team has a record of who passed which quiz. When you remove a repository from Reviewsaur, its quizzes, responses, and settings are deleted with it. For account or team deletion, email [email protected].
6. Security measures
- All traffic is encrypted in transit (TLS, with HSTS enforced).
- A strict Content-Security-Policy,
X-Frame-Options: DENY, andnosniffheaders are set on every response — you can verify them from your browser’s dev tools. - Prompts sent to the AI provider wrap your diff as untrusted data and instruct the model to treat it as content, not instructions — a mitigation against prompt injection hidden in code.
- Quiz access requires GitHub sign-in and membership of the team that owns the repository; the quiz link alone grants nothing.
7. GDPR, DPA & sub-processors
Reviewsaur is operated from Poland and built for the GDPR: for your team’s code and PR content, we act as a data processor on your behalf. Our Privacy Policy describes the controller and processor roles, international transfer safeguards (EU Standard Contractual Clauses), and the full list of sub-processors. A signed Data Processing Agreement is available on request at [email protected].
8. Reporting a vulnerability
If you believe you’ve found a security issue in Reviewsaur, please email [email protected] and we’ll respond quickly. A machine-readable contact is published at /.well-known/security.txt.