Legal
Privacy Policy
Last updated: June 2026
1. Information We Collect
When you sign in with GitHub, we receive your GitHub username, email address, name, and avatar URL. We store this to identify your account and display it in the dashboard. We also collect installation data: which repositories you have authorized OpenMerge to review.
2. Code Access
To generate pull request reviews, OpenMerge temporarily reads the diff of each pull request from GitHub via the GitHub API. We do not store your source code. Diff content is processed in memory, passed to the AI agents, and discarded after the review job completes.
3. Review Data
We store review session metadata (PR number, review status, comment count, timestamps) associated with your account. This data is used to power the OpenMerge dashboard. You can delete your account and all associated data at any time from Settings.
4. Third-Party Services
OpenMerge uses the GitHub API to read diffs and post review comments. AI agents may use third-party model APIs (e.g., Google Gemini). Diff excerpts may be sent to these providers solely for the purpose of generating review content. We do not sell your data to third parties.
5. Data Security
We use HTTPS for all data in transit. Secrets (GitHub App private keys, JWT secrets) are stored as environment variables and never committed to source control. JWT tokens expire after 7 days and are not stored server-side.
6. Cookies and Session
We use session cookies managed by NextAuth.js to maintain your authenticated session in the dashboard. We do not use tracking cookies or analytics cookies.
7. Data Retention
Account data is retained until you delete your account. Review session metadata is retained for up to 90 days and then purged. If you uninstall the GitHub App, your installation data is removed within 30 days.
8. Your Rights
You have the right to access, correct, or delete your personal data. To exercise these rights, contact us at privacy@openmerge.xyz. We will respond within 30 days.
9. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of significant changes via email or a notice in the dashboard. Continued use of the Service after notification constitutes acceptance.
10. Contact
For privacy-related questions, contact us at privacy@openmerge.xyz.