Privacy Policy

Last updated: April 2, 2026

1. Who We Are

NeuronX Guard is operated by SreeJagatab (Ganesh Jagatab), based at Jagatab.UK. Contact: [email protected].

2. What We Collect

Data	Purpose	Retention
GitHub username, email, avatar	Account creation, display	Until account deletion
GitHub OAuth token	Access repos/PRs during review	Session only, not stored
PR diffs (code changes)	Code review analysis	Processed in memory, not stored
Review results (issue counts, timestamps)	Analytics, quality tracking	Until account deletion
Dismiss/reaction patterns	Learning from feedback	Until account deletion
Payment info (via Stripe)	Billing for paid plans	Managed by Stripe

3. What We Do NOT Collect

• We do not store your source code or full repository contents
• We do not train AI models on your code
• We do not sell, share, or rent your data to third parties
• We do not track you across other websites
• We do not use advertising cookies or trackers

4. How Code Is Processed

When a PR is opened, Guard fetches the diff (changed lines only) from GitHub's API. The diff is analyzed in memory by our review pipeline (pattern matching, AST analysis, LLM review). After the review, the diff is discarded. Only aggregated results (issue counts, severity, review time) are stored.

5. Third-Party LLM Providers

Guard uses multiple LLM providers for the multi-model consensus feature. Diffs may be sent to these providers for analysis. We use providers with data handling agreements. Diffs are sent as ephemeral requests — providers do not store or train on the data.

6. Data Storage

• Account data: PostgreSQL database (encrypted at rest)
• Review metadata: PostgreSQL or SQLite
• Payments: Stripe (PCI-DSS compliant)
• Sessions: JWT cookies (httpOnly, secure, 7-day expiry)

7. Your Rights

You can:

• Access: View your data in the dashboard
• Delete: Uninstall the GitHub App and email us to delete your account
• Export: Use the /guard report command to export review data
• Correct: Update your profile via GitHub (syncs automatically)

8. Cookies

We use one essential cookie:

• guard_session — JWT authentication token (httpOnly, secure, 7 days). No tracking cookies.

9. Security

We use HTTPS for all connections, verify GitHub webhook signatures, use parameterized queries to prevent SQL injection, and follow OWASP security guidelines. We hash and sign all JWT tokens with HMAC-SHA256.

10. Children

The Service is not intended for children under 13. We do not knowingly collect data from children.

11. Changes

We may update this policy. Material changes will be communicated via the dashboard. Continued use constitutes acceptance.

12. Contact

For privacy questions or data deletion requests: [email protected]