LlamaPReview - Privacy Policy

Last updated: August 10, 2026

This page describes how the official hosted LlamaPReview GitHub App and website handle data. Self-hosted deployments are operated by their deployers and are outside this policy.

1. Eligible public pull requests

When an eligible public pull-request event arrives with a valid GitHub webhook signature, LlamaPReview may handle:

GitHub App installation, repository, pull-request, delivery, and exact-head identifiers needed to run and recover the review;
selected public repository content used as review evidence, with provenance and coverage records;
prompts built from that evidence and generated provider output;
the projected main review, inline requests, and optional sanitized Mermaid diagram;
provider usage, token, model-identity, and cost-accounting records; and
operational run state, artifacts, traces, and logs within the periods below.

2. Private-repository event boundary

New private-repository events stop before product processing.

The hosted service verifies the webhook signature and parses only the minimum event and visibility fields. If the repository is private, it returns a generic acknowledgement and discards the payload. It does not create a durable product record, call DeepSeek, invoke the Pipeline, call GitHub product APIs, or log repository or pull-request identity for that event.

This is the current boundary for new events. It does not mean historical private-repository records from earlier operation were deleted. Those records were deliberately left untouched; no launch cleanup, export, migration, or backfill was run over them.

3. Processing and service providers

GitHub. The GitHub App receives signed pull-request webhooks, retrieves public repository evidence, and publishes eligible reviews to the exact verified head.

AWS. Webhook receipt, Pipeline processing, product storage, logging, and alarms run in the AWS Singapore region. LlamaPReview uses Lambda, DynamoDB, S3, CloudWatch, and IAM.

DeepSeek. For eligible public pull requests, selected public evidence, prompts, and generated output are sent to DeepSeek's API for engineering judgment. Those requests leave the AWS environment for DeepSeek processing.

DeepSeek documents default on-disk API context caching, normally cleared within hours to days once unused. Its public Open Platform terms do not provide a categorical no-training assurance or one fixed overall retention period for all API data. Read DeepSeek's Open Platform terms and context-cache documentation for its current statements.

4. Storage and security

S3 public-run artifacts and traces: private bucket, all public-access blocks enabled, S3-managed encryption at rest, and bucket-owner-enforced object ownership. Versioning is currently disabled.
DynamoDB run records: encryption at rest, point-in-time recovery, and TTL enabled.
Lambda environment secrets: AWS built-in encryption at rest and strict IAM. The official service does not add Secrets Manager, Parameter Store SecureString, or a customer-managed KMS key.
Public source and CI: release artifacts are built deterministically, scanned, checksummed, and attested. Public CI cannot read production configuration or deploy the official service.

This is encryption at rest and access control, not a claim of end-to-end encryption across GitHub, AWS, and DeepSeek.

5. Data Retention

Official-service data	Configured retention
DynamoDB public-run records	30-day TTL; AWS deletion after expiry is asynchronous
S3 public-run artifacts	30 days
Full provider trace objects	7 days
Webhook CloudWatch logs	30 days
Pipeline CloudWatch logs	90 days

These periods describe LlamaPReview's AWS configuration. DeepSeek controls its own processing and retention under its terms. DynamoDB TTL is an expiry marker, not an immediate deletion guarantee.

6. Choices and questions

Uninstalling the GitHub App stops new events for that installation. It does not retroactively delete records already created; current public-run records continue through the retention process above.

Use Discussions for data-handling questions, Issues for a reproducible public-service problem, and the private Security Policy route for vulnerabilities or sensitive reports. Do not post private source, credentials, provider payloads, installation IDs, or private logs in public channels.

7. Website data

The website is a static GitHub Pages site. LlamaPReview does not configure a website analytics or tracking script. Requests are still handled by GitHub Pages and external assets may be delivered by their hosts under their own policies.

8. Changes to this policy

This page may change when the service or its observed configuration changes. The date above identifies the current version.