Privacy policy

The data controller for the hosted service is Alex Wakeman, an individual sole trader based in the United Kingdom, contactable at wakemana@gmail.com. Pierre is a small independent project, not a company with a privacy department: the same person who wrote the code answers the email.

Because the controller is UK-based, the UK GDPR and the Data Protection Act 2018 apply, and the EU GDPR applies to visitors and users in the EEA. If you are in California, see §11.

The marketing pages you are reading now are static. They set no cookies and run no third-party scripts until you agree to them. Specifically:

• Google Analytics 4 — used to count page views and see which pages are useful. It writes a first-party _ga cookie and sends your IP address, approximate location, device/browser details and the pages you view to Google. It runs only if you press Accept on the cookie banner. Decline and the script is never even downloaded. Google Signals and ad personalisation are switched off, so the data is never joined to an advertising profile. Full detail, including how to change your mind, is in the cookie policy.
• Fonts and assets — the brand typeface and every image are served from this domain. There is no Google Fonts request, no CDN and no tracking pixel, so loading a page discloses nothing to a third party.
• Server logs — the hosting provider records request metadata including your IP address, for security and debugging. See §6.

Legal basis: consent (UK/EU GDPR Art. 6(1)(a)) for analytics; legitimate interests (Art. 6(1)(f)) for keeping the service secure and available.

Signing in uses GitHub OAuth. We never see or store a password. What we do store:

Legal basis: performance of a contract (Art. 6(1)(b)) — this is the data required to provide the service you asked for.

Pierre's purpose is to show a team's pull-request activity. When you add a repository, Pierre copies recent activity from GitHub into its database so it can be searched, filtered and charted. That includes:

• pull request titles, descriptions, state, timestamps, labels and CI results;
• review comments, review bodies and issue comments — the actual text people wrote;
• commit SHAs, messages and the file paths each commit touched;
• the GitHub username, display name and avatar of everyone who authored, reviewed or commented on any of it;
• metrics derived from the above (review turnaround, bot activity, and so on).

This means Pierre processes personal data about people who never signed up for it — your colleagues, and any outside contributor to a repository you watch. We are stating that plainly because it is true of every tool in this category and is rarely admitted.

Two things limit it. First, Pierre only ever reads what the connected GitHub token can already read, so it can never surface anything the account holder was not already entitled to see. Second, by default Pierre stores less than it could: pull-request descriptions, diff hunks and commit messages are not persisted at all unless the operator turns that on — they are fetched from GitHub on demand when you open a pull request, and cached in your browser rather than on the server.

Legal basis: legitimate interests (Art. 6(1)(f)) — the interest being a development team's ability to see and manage its own review workload. The data is professional activity that the individuals concerned published in a collaborative workspace, the processing is limited to what the team's existing access already permits, and it is not used for profiling, advertising or any decision about the individual. If you are deploying Pierre for a team, you are likely a joint or independent controller for this data under your own privacy notice; contact us at wakemana@gmail.com if you need a data processing agreement.

We use a small number of processors. No data is sold, and there are no advertising or data-broker relationships.

Transfers outside the UK/EEA rely on the UK International Data Transfer Addendum and the EU Standard Contractual Clauses, as incorporated in each provider's data processing terms. We may also disclose data where legally required, or to protect the service against abuse.

• Repository activity — pull requests and everything attached to them are deleted automatically once they have been inactive for 180 days. This runs nightly; nothing accumulates indefinitely.
• Your account — kept until you delete it. Deleting removes the account row, your encrypted token, every repository you added and all the activity synced for them.
• Server logs — retained by the hosting provider for a short operational window (days, not months). Credentials are redacted before anything is written.
• AI usage records — a running count of tokens and credits used per month, for billing and quota. The prompts themselves are not stored by us.
• Billing records — held by Stripe for as long as UK tax law requires (currently six years).

Pierre's AI features are opt-in and clearly labelled. When you use one — a repository digest, a pull-request summary, team insights, an AI review — the relevant content is sent to Anthropic to generate the result. That content can include source-code diffs, review comments and the names of the people involved.

Anthropic acts as our processor and, under its commercial terms, does not use this content to train its models. Even so: treat an AI feature as a decision to share that code and those comments with a third party, and do not enable it on a repository where that would be inappropriate. Nothing is sent unless you press the button.

On a local install, AI features use your own Anthropic credentials and the content goes from your machine to Anthropic directly — we are not in the path and never see it.

The hosted app offers an optional benchmark that compares your review-bot metrics against an aggregate of other organisations. It is off unless you switch it on. When enabled, aggregate, non-identifying counts are contributed to that pool — never repository names, pull-request contents or usernames. You can turn it off at any time in settings, which stops further contribution.

Legal basis: consent (Art. 6(1)(a)), withdrawable at any time.

Under UK/EU GDPR you can ask us to: give you a copy of your data (access and portability), correct it, delete it, restrict or object to how we use it, and withdraw any consent you have given. Exercising a right never costs you anything and never degrades the service.

Two of these are self-service in the hosted app, under Settings → Your data:

• Export — downloads everything associated with your account as a single JSON file.
• Delete account — irreversibly removes your account, your encrypted GitHub token, your repositories and all synced activity. It also revokes Pierre's access to your GitHub account.

For anything else, or if you are not a user but your GitHub activity appears in someone's Pierre instance, email wakemana@gmail.com and we will respond within one month. To help with the second case: we hold that data on behalf of whichever account added the repository, so we may need to put you in touch with them — include the repository name if you can.

If you are unhappy with how we handle it, you can complain to the UK Information Commissioner's Office, or to your own EU supervisory authority.

GitHub tokens are encrypted at rest with AES-256-GCM under a key held only in the server environment. Session cookies are sealed, HTTP-only and same-site. All traffic is HTTPS with HSTS. Every database query is scoped to the owning account, and that isolation is enforced by an automated check in the build. Credentials are redacted from logs. The application is open source, so you can verify all of this rather than take our word for it.

No system is perfect. If you find a vulnerability, please report it privately to wakemana@gmail.com rather than opening a public issue.

We do not sell personal information and do not share it for cross-context behavioural advertising, as those terms are defined by the CCPA/CPRA. You have the right to know what we collect (§§2–4), to delete it, to correct it, and not to be discriminated against for asking. Use the self-service controls in §9 or email wakemana@gmail.com. We do not knowingly collect data from anyone under 16.

If this notice changes materially we will update the date at the top and, where the change affects consent, re-ask for it. The full history is in the public git repository, so you can diff any version against any other.