Privacy Policy

PatchFlow (“we”, “us”) is an autonomous API reliability and self-healing platform. You sign in with GitHub, connect repositories, and optionally install our SDK to monitor live errors. This policy explains honestly what data we collect, why, who processes it, how long we keep it, and how to delete it.

Summary

• We sign you in with GitHub OAuth and request repo, profile, and email scopes.
• We read your repository code to analyze failures and write fixes, and open Pull Requests on your behalf.
• Our SDK collects error types, messages, and stack frames from your app — never request bodies, headers, cookies, or your end users' PII.
• All incoming error text is run through automated PII redaction before it is stored.
• To generate fixes, error context and relevant code snippets are sent to our AI model provider (Google Gemma).
• Error logs are retained for your plan's window (7, 30, or 90 days) and then deleted.
• You can request deletion of your data at any time.

1. Data we collect when you sign in

PatchFlow uses GitHub OAuth for authentication. When you click “Continue with GitHub”, you authorize the following scopes:

• repo — read and write access to your public and private repositories. We use this to read your code for analysis, clone a repository to generate a fix, create a branch, push commits, and open a Draft Pull Request.
• read:user — read your GitHub profile (username and avatar).
• user:email — read your email address, including your primary verified email if your address is private.

We store your GitHub username, avatar URL, email address, and the OAuth access token issued for your account. The access token is stored server-side in our database and used only to read your repositories and open Pull Requests on your behalf. We never share your token with third parties. You can revoke our access at any time from your GitHub settings, which immediately invalidates the token.

2. Repository access and your code

When you connect a repository and trigger a scan or when the SDK pipeline generates a fix, PatchFlow:

• Reads the repository to discover endpoints and analyze the failing code path.
• Creates a temporary clone of the repository on our server to apply and verify a proposed fix.
• Creates a new branch, commits the generated change, and opens a Draft Pull Request for your review.

Pull Requests are automated suggestions. You are responsible for reviewing and testing changes before merging. Sensitive files (auth, billing, payments, credentials, migrations) are blocklisted and are never auto-patched. Temporary working clones are short-lived and removed after a fix run completes.

3. Data collected by the PatchFlow SDK

If you install the PatchFlow SDK in your application, it reports unhandled errors to PatchFlow. On each captured error, the SDK sends:

• Error type and error message (truncated to 1,000 characters).
• The endpoint or route path, HTTP method, and status code where the error occurred.
• Stack frames: file path, line number, and function name (internal library frames are filtered out).
• Detected framework (for example Next.js, Express, Node) and the environment name.
• SDK version.

The SDK is designed to never collect request bodies, request or response headers, cookies, environment variables, or personally identifiable information about your end users. All incoming error text is passed through an automated PII redaction step before it is stored. The SDK is engineered to fail silently — if PatchFlow is unreachable or waking up, it times out quickly and never throws, so it cannot break your application.

4. How we use your data

• To authenticate you and manage your account.
• To read your repositories, analyze failures, and generate code fixes.
• To open Draft Pull Requests in your connected repositories.
• To send you incident alert emails when configured.
• To process subscription payments and enforce plan limits.
• To operate, secure, and improve the service.

We do not sell your data. We do not use your repository code to train models. Code and error data are processed solely to provide the service to you.

5. AI processing

To generate proposed fixes, we send the failing error context (error type, message, stack frame, and surrounding code snippets) to our AI model provider, Google's Gemma API. The code snippets transmitted are limited to what is needed to produce a fix for the specific failure. Processing by our AI provider is governed by their privacy terms.

6. Data retention

Error logs and incident records are retained for the window defined by your plan and then deleted:

• Hobby (Free): 7 days.
• Developer Pro: 30 days.
• Team & Business: 90 days.

Temporary repository clones created during a fix run are removed after the run completes. Your account data (profile, email, connected repositories, and settings) is retained until you delete your account or disconnect the integration. Generated Pull Requests remain in your GitHub repository under your control.

7. Third-party processors

We rely on the following sub-processors to operate PatchFlow. Each processes data only as needed to provide the service:

• Render — application and web hosting (region configurable per account).
• Aiven — managed PostgreSQL database where your account, site, and error data are stored (region configurable).
• Google (Gemma / Generative Language API) — AI inference used to generate proposed fixes from error context and code snippets.
• GitHub — OAuth authentication and repository access, including Pull Request creation.
• Lemon Squeezy — payment processing as Merchant of Record.
• Resend — transactional email delivery for incident alerts.

8. Where your data is stored

Your primary data is stored in a PostgreSQL database hosted on Aiven and in the application servers hosted on Render. The specific cloud region for each service is set by the service operator at deploy time. Data in transit is encrypted with TLS. The database connection requires SSL. Contact us for the active regions for your account.

9. Security

• All traffic to and from PatchFlow is encrypted over HTTPS/TLS.
• The database connection uses SSL (sslmode=require or stricter).
• All secrets, tokens, and API keys are stored in environment variables on the hosting provider and are never committed to source control.
• Sensitive file paths are blocklisted so authentication, billing, and credential files are never auto-patched.
• Incoming error payloads are PII-redacted before storage.

10. Cookies

We use essential cookies to keep you signed in (your session token). These are necessary and require no consent. With your explicit consent, we may load privacy-friendly analytics on public pages to understand how PatchFlow is used. You can accept or reject analytics via the consent banner, and change your choice anytime — your preference is stored locally on your device. Authenticated app pages do not load marketing analytics. The PatchFlow SDK's own error reporting is separate from and never shared with marketing analytics.

11. Your rights and data deletion

You can exercise the following at any time:

• Access — request a copy of the data we hold about you.
• Deletion — request that we delete your account, error logs, and associated data.
• Disconnect — revoke PatchFlow's GitHub access from your GitHub settings, or remove a monitored site in the dashboard.

To request access to or deletion of your data, email privacy@patchflow.cloud from the address on your account and we will action your request, typically within 30 days. You can also delete your account from Settings.

12. Children's privacy

PatchFlow is intended for developers and businesses. We do not knowingly collect data from anyone under 16. If you believe a minor has registered, contact us and we will delete the account.

13. Changes to this policy

We may update this policy as the service evolves. We will post the updated version here with a new “Last updated” date and, for material changes, notify active users by email.

14. Contact

Questions about this policy or your data? Email privacy@patchflow.cloud. For general support, contact support@patchflow.cloud.