Privacy policy

Last updated: 19 October 2026

Who is responsible

The controller is Gaurav Sharma, contact details in the Impressum. Email: [email protected]

This policy covers two things: this website (mergejudge.si) and the MergeJudge GitHub App with its hosted service (app.mergejudge.si and our Cloudflare Worker). The open-source runner runs on your own machine or CI; what it exchanges with our service is described below.

1. This website

This site is delivered through Cloudflare (Cloudflare, Inc.). To deliver the site and keep it secure, Cloudflare processes your IP address and technical request data (requested page, time, browser type) in server logs.

• Purpose: delivering the website and protecting it against abuse.
• Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in a secure, working website.
• Transfers outside the EU: possible. Cloudflare is certified under the EU-US Data Privacy Framework.

We do not use analytics, set cookies, or load third-party scripts, fonts, images or embeds. The site has no forms or accounts. Your browser may keep your light/dark theme choice in its own local storage; it is never sent to us.

2. The MergeJudge GitHub App

What we process

When you install the app, GitHub sends us installation and pull request events. We process:

• Account and installation data: GitHub account or organisation name and IDs, installation ID, repository names and IDs, and the GitHub usernames involved in pull requests and in actions on the app (for example who merged a pull request, changed a label or signed in to the panel).
• Pull request content: PR metadata (title, description, author, labels, commit IDs), the diff, your policy files and related code snippets, read from GitHub to run the review.
• Your AI provider key, if you add one: stored encrypted in our database (Cloudflare D1) and used only to call the provider you chose for your reviews. Adding a key with the same name replaces the old one. The key is deleted when you remove it in the panel, or when you uninstall the app.
• Sign-in session for the MergeJudge panel (app.mergejudge.si): when you sign in with GitHub, the panel sets two strictly necessary cookies, limited to the panel: mj_oauth (protects the sign-in step, deleted after sign-in or after 10 minutes) and mj_s (keeps you signed in, deleted when you sign out or after 8 hours). The session itself (your GitHub username, avatar link and the GitHub sign-in token) is stored on our side for the same 8 hours and deleted when you sign out. These cookies need no consent (§ 25(2) TDDDG). The panel shows your avatar image, which your browser loads directly from GitHub.

Legal basis: Art. 6(1)(b) GDPR (providing the service you installed) and Art. 6(1)(f) GDPR (security, abuse prevention, keeping the service running).

Where AI review happens

• With your own provider key: the relevant code is sent from our Worker to the AI provider you chose, under your own account and that provider's terms and privacy policy. We do not control how that provider handles data; please check its settings, for example whether it uses API data for training.
• With the open-source runner: the AI review runs on your machine or CI. In the default modes our Worker reads the diff and related code from GitHub and hands it to your runner. In deep-local mode the AI step and code index run on your machine. Our servers still read the pull request diff from GitHub to run the rule checks, and don't store it.
• We do not run AI reviews on our own key for other users, and we do not build a code index of your repositories.

How long we keep it

• Code (diffs, policy files, snippets): used only while the review runs. With your own key, code is processed in memory during the review and not stored. Code handed to a runner is removed from our database as soon as the review finishes. A review that no runner picks up is cancelled after 24 hours, and a daily cleanup removes any code that is left, so code is deleted within about 48 hours at the latest.
• Review results (lane, reasons, summary, findings, the same text posted on your PR; may quote short lines of code) and the PR metadata of runner reviews: up to 90 days, then deleted.
• Cached AI results: 7 days.
• Learning data (how findings were treated, for example dismissed or fixed, with the finding text of up to 200 characters, which may quote a line of code; the lane each PR got and what humans did with it): kept while the repository is linked, deleted 7 days after you unlink the repository or uninstall the app. Lessons the app proposes are written to a branch in your own repository on GitHub, where you control them.
• Webhook delivery IDs (deduplication only): 24 hours.
• Worker logs (status lines such as repository, PR number, file paths, GitHub usernames and outcome; tokens and keys redacted, never code or diffs; plus the request data Cloudflare records for each request): kept by Cloudflare for up to 7 days.
• Usage counts (no code): deleted 7 days after you unlink the repository or uninstall the app.
• Audit entries (which action was taken, by which GitHub username, when; no code and no key values): kept up to 12 months as a record of changes to your installation's settings, then deleted.

To delete your data sooner, unlink the repository in the MergeJudge panel, uninstall the app, or email us.

Who else processes data

• Cloudflare, Inc. (Workers, D1, KV, Queues, R2, logs) as our processor, under its Data Processing Addendum. Data may be processed outside the EU; Cloudflare is certified under the EU-US Data Privacy Framework.
• GitHub, Inc. is a separate controller for everything on GitHub; its privacy statement applies.
• Your chosen AI provider, when you use your own key (see above).

We do not sell data, show ads, or use your code to train models.

3. Links to other sites

Links to GitHub, npm and others take you to sites whose own privacy policies apply.

4. Your rights

Under the GDPR you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), and to object to processing based on legitimate interests (Art. 21). Email [email protected].

You can also complain to a data protection supervisory authority, for example the one where you live or the one responsible for us: Berliner Beauftragte für Datenschutz und Informationsfreiheit.

We make no automated decisions with legal or similarly significant effects about you. A review is advice on a pull request; you decide whether to merge.