Privacy

PR Aura stores only what it needs to keep balances. Last updated 2026-10-20.

Who we are

PR Aura is run by Felix Galindo, an individual based in Venezuela ("we"). Contact: fxgal.dev@gmail.com.

Who decides about the data

• The organization or user that installs PR Aura decides to use it for its developers. For the data about its members, the organization is the controller and we are its processor: we process that data only to run PR Aura for that organization, under the terms and its config. A data processing agreement is available on request.
• For beta access requests sent to us by email, and for keeping the service secure, we are the controller.

What PR Aura stores

• Numeric GitHub ids of the installation, the account and the repositories, the account type, repository names and the number of the leaderboard issue.
• GitHub user ids and logins of the people who take part. Logins are needed to mention people.
• Pull request numbers, state (open, draft, merged or closed), size tier and changed line count, commit SHAs, dates, and the ids of the check and the comment the bot publishes.
• The type of each review (approve, request changes or comment), never its text, and when each pull request first got a review from someone other than its author.
• A baseline measured on install: the median time to first review of the pull requests opened in the 28 days before, and how many there were. Only these figures are stored, not the pull requests they come from.
• The aura ledger: initial balances, grants, merge costs and rewards, and who bypassed a PR.
• Your organization's config, read from .github/pr-aura.yml, and the commit it came from. It includes the logins listed as admins, excluded or exempt, and their GitHub user ids.
• Webhook delivery records: delivery id, event and action, status, attempts, dates and a short error code, without the payload.

What PR Aura never stores

• Code, diffs or file contents. To measure size it reads file names, line counts and the repository's .gitattributes, without storing them.
• PR titles or descriptions, comments, review bodies or emails.
• Webhook payloads.

This website uses no cookies and no analytics.

Legal basis

• Member data: the installing organization chooses the legal basis for using PR Aura with its team, usually its legitimate interest in running its code review process. We process that data on its behalf.
• Providing the service: the data listed above is what is needed to provide PR Aura to the organization that installed it, under the terms.
• Security and operation: operational logs and error reports rely on our legitimate interest in keeping PR Aura working and secure.
• Beta access emails: the steps you ask for before joining the beta, and our legitimate interest in running it.

Providers

• GitHub: where the app runs and where it publishes checks, comments and the leaderboard issue. The data PR Aura reads comes from GitHub.
• Vercel: hosting and operational logs, in United States (Washington, D.C.). Logs contain numeric ids, never logins.
• Supabase: the Postgres database that holds the data listed above, in United States (East US, North Virginia).
• Sentry: error reports, without user data, request payloads, headers or cookies, in the United States.
• Google: hosts the mailbox of fxgal.dev@gmail.com, where beta access requests and data requests arrive.
• PayPal: only if you donate. PayPal processes the payment under its own privacy policy, and we receive the name, email address and amount it shows us. We keep them only for our accounting records.

International transfers

The data is stored and processed in the United States, and we access it from Venezuela. If you are elsewhere, for example in the EU or the UK, your data is transferred there. For those transfers we rely on the safeguards in our providers' data processing terms, such as the EU Standard Contractual Clauses.

Retention

• Members, balances, ledger, pull requests, reviews, config and the baseline are kept while the app is installed.
• Webhook delivery records are deleted 30 days after they are processed. Failed ones are kept so they can be retried.
• Vercel logs and Sentry reports expire with those services' retention.

When you uninstall

Uninstalling the app deletes all of your organization's data: members, balances and ledger, pull request records, reviews, config, the baseline and webhook delivery records (except the record of the uninstall event itself, which holds only numeric ids and is deleted after 30 days).

What PR Aura cannot delete after uninstalling, because it no longer has access: the leaderboard issue and the comments the bot posted on GitHub (delete them yourself), and operational logs in Vercel and Sentry, which contain only numeric ids, never logins, and expire with those services' retention.

Your rights

You can ask for access to your data, to correct it, to delete it, or object to its processing. If you are in the EU or the UK, you have these rights under the GDPR wherever we are based. You can also complain to the supervisory authority of the country where you live or work.

If your organization uses PR Aura, it decides about your data: ask it first. You can also write to fxgal.dev@gmail.com and we will help you and your organization. We reply within one month.

Deleting one person without uninstalling

Send an email to fxgal.dev@gmail.com from the organization, or from the person with the organization in copy. We check the request and delete that person's record by hand: their balance, ledger entries and reviews. Their pull request records stay, without a link to them.

• PR Aura records a person again the next time they open or review a pull request. To stop that, the organization adds them to excluded in .github/pr-aura.yml.
• Logins listed in .github/pr-aura.yml stay in the stored config until the organization removes them from the file.
• The bot's past comments and the history of the leaderboard issue are on GitHub and out of our reach. The organization can edit or delete them.

Beta access requests

To join the beta you write to fxgal.dev@gmail.com. We keep your email address, your message and the GitHub account you want to install PR Aura on, only to answer you and run the beta. If you are accepted, the numeric id of that account goes on the list of accounts allowed to install the app. We delete these emails when the beta ends, or earlier if you ask.

Changes to this policy

We may update this policy. The date at the top changes when we do, and the new version applies from that date.

Contact

Questions or requests about your data: fxgal.dev@gmail.com.