Privacy and security

What we store

• Time spent on each file of each pull request, per reviewer.
• Your GitHub identity (id, login, avatar), to show who read what.
• The changed-file list of each watched PR: paths and added/deleted line counts.
• Workspace-level billing metadata.

What we never store

• Source code. The extension never reads or transmits the diff body, and the GitHub App does not request code contents.
• Keystrokes, scroll positions inside files, mouse movement, or screenshots.
• Anything from outside github.com pull request pages.
• Third-party analytics or trackers in the dashboard, sign-in, invites or public review logs. Marketing pages use Google Analytics 4 with advertising signals off; the dashboard and extension send first-party product telemetry to our own infrastructure.

How measurement stays honest

Dwell time counts only while the tab is focused and a file's rendered diff is on screen. Collapsed diffs, background tabs, and excluded files earn nothing. The full mechanics are in How it works. Every extension request is visible in your browser's network inspector.

Retention

• Per-file reading state clears when a PR closes or merges.
• Aggregate reviewer history is kept 90 days, then deleted. Business and Enterprise workspaces can opt into longer audit retention.

Access and tokens

• Extension tokens are bearer tokens scoped to reading endpoints. Each reviewer can list and revoke theirs at dashboard settings (readpr.dev/dashboard/settings) ; disconnecting from the popup revokes server-side too.
• Workspace data is visible only to workspace members, scoped by role.
• The GitHub App asks for the minimum: check runs, pull request metadata, and repository metadata.

Deleting your data

1. Uninstall the GitHub App from the org. The workspace is suspended immediately and webhook ingestion stops.
2. Email privacy@readpr.dev to permanently delete the workspace and all reading history. Requests are actioned within seven days.