LlamaPReview - Privacy Policy

Last updated: November 2, 2026

This page describes how the official hosted LlamaPReview GitHub App and website handle data. Self-hosted deployments are operated by their deployers and are outside this policy. This update corrects the hosted provider disclosure to direct OpenAI. The AWS storage and retention settings below were last verified on August 12, 2026 and were not revalidated as part of this update.

1. Eligible public pull requests

When an eligible public pull-request event arrives with a valid GitHub webhook signature, LlamaPReview may handle:

GitHub App installation, repository, pull-request, delivery, and exact-head identifiers needed to run and recover the review;
selected public repository content used as review evidence, with provenance and coverage records;
prompts built from that evidence and generated provider output;
the projected main review, inline requests, and optional sanitized Mermaid diagram;
provider usage, token, model-identity, and cost-accounting records; and
operational run state, artifacts, traces, and logs within the periods below.

2. Private-repository event boundary

New private-repository events stop before product processing.

The hosted service verifies the webhook signature and parses only the minimum event and visibility fields. If the repository is private, it returns a generic acknowledgement and discards the payload. It does not create a durable product record, call a model provider, invoke the Pipeline, call GitHub product APIs, or log repository or pull-request identity for that event.

This is the current boundary for new events. It does not mean historical private-repository records from earlier operation were deleted. Those records were deliberately left untouched; no launch cleanup, export, migration, or backfill was run over them.

3. Processing and service providers

GitHub. The GitHub App receives signed pull-request webhooks, retrieves public repository evidence, and publishes eligible reviews to the exact verified head.

AWS. Webhook receipt, Pipeline processing, product storage, logging, and alarms run in the AWS Singapore region. LlamaPReview uses Lambda, DynamoDB, S3, CloudWatch, and IAM.

OpenAI. For eligible public pull requests, selected public repository evidence and prompts are sent directly to the OpenAI API for engineering judgment. Generated responses can be included in subsequent review-stage requests. These requests leave LlamaPReview's AWS environment; the AWS region does not establish where OpenAI processes them.

The direct adapter uses the Responses API with store=false and background=false. These settings do not guarantee zero retention. OpenAI states that API data is not used for model training by default unless the account opts in to sharing. Its default abuse-monitoring logs may contain prompts, responses and related metadata for up to 30 days, with longer retention possible for legal or safety reasons. Account-level controls and exceptions apply; this policy does not assert Zero Data Retention for the hosted account.

The hosted review path uses prompt caching. Its 30-minute cache setting is a minimum reuse lifetime, not a deletion deadline. OpenAI documents a maximum 24-hour retention period for encrypted prompt-cache state, separate from abuse-monitoring logs and LlamaPReview's AWS retention. Read OpenAI's current API data controls and prompt-caching documentation.

Changing providers does not retroactively delete data previously processed by another provider. Self-hosted provider settings, including OpenRouter and DeepSeek, do not describe the current official hosted service.

4. Storage and security

The following AWS controls describe the configuration verified on August 12, 2026.

S3 public-run artifacts and traces: private bucket, all public-access blocks enabled, S3-managed encryption at rest, and bucket-owner-enforced object ownership. Versioning was disabled at that verification.
DynamoDB run records: encryption at rest, point-in-time recovery, and TTL enabled.
Lambda environment secrets: AWS built-in encryption at rest and strict IAM. The official service does not add Secrets Manager, Parameter Store SecureString, or a customer-managed KMS key.
Public source and CI: release artifacts are built deterministically, scanned, checksummed, and attested. Public CI cannot read production configuration or deploy the official service.

This is encryption at rest and access control, not a claim of end-to-end encryption across GitHub, AWS, and OpenAI.

5. Data Retention

Official-service data	Last verified retention (August 12, 2026)
DynamoDB public-run records	30-day TTL; AWS deletion after expiry is asynchronous
S3 public-run artifacts	30 days
Full provider trace objects	7 days
Webhook CloudWatch logs	30 days
Pipeline CloudWatch logs	90 days

These periods describe the last verified LlamaPReview AWS configuration, not a newly verified snapshot. OpenAI controls its own processing and retention under its API policies and the applicable account settings. DynamoDB TTL is an expiry marker, not an immediate deletion guarantee.

6. Choices and questions

Uninstalling the GitHub App stops new events for that installation. It does not retroactively delete records already created; current public-run records continue through the retention process above.

Use Discussions for data-handling questions, Issues for a reproducible public-service problem, and the private Security Policy route for vulnerabilities or sensitive reports. Do not post private source, credentials, provider payloads, installation IDs, or private logs in public channels.

7. Website data

The website is a static GitHub Pages site. LlamaPReview does not configure a website analytics or tracking script. Requests are still handled by GitHub Pages and external assets may be delivered by their hosts under their own policies.

8. Changes to this policy

This page may change when the service or its observed configuration changes. The date above identifies the current version.