Privacy & data handling.
clud-bug reads each pull request’s diff and your skill files, sends them to Anthropic for review, and writes the result back to the PR. We retain almost nothing — only short-lived idempotency keys and your per-install configuration.
Last updated: June 2026. This describes the data handling of the hosted clud-bug[bot] GitHub App. The App’s entire source is open — every data path below is auditable at github.com/thrillmade/clud-bug-app.
1. What the App reads
On install, the GitHub App receives an installation access token scoped to these permissions — and no others:
| Permission | Why |
|---|---|
pull_requests: write | Read PR metadata + diff; post the inline review threads and the summary comment; resolve threads on verified fixes. |
contents: write | Read skill manifests at the PR’s base ref; push auto-fix commits (only when explicitly enabled per-install). |
checks: write | Post a check-run so the PR’s status reflects the review verdict. |
issues: write | Post the summary as a top-level PR comment (GitHub treats these as issue comments). |
metadata: read | Required for any install; read-only repo metadata (name, default branch). |
We do not request administration, secrets, actions, members, or any org-admin scopes. The token is scoped per installation — uninstalling revokes it.
2. What we send to Anthropic
For each review, the App sends to Anthropic’s API:
- The PR’s unified diff (what
git diff base...headproduces). - The bodies of the skill files resolved for that review (from
.claude/skills/at the base ref, plus any catalog skills you opted into). - A static system prompt and the schema the reviewer emits findings against.
- The PR metadata needed to attribute comments (number, base/head SHA, file paths).
We do not send repository contents outside the diff (no full-repo crawl), files at paths not in the diff, or your GitHub credentials (Anthropic never sees the installation token).
Visual design review (Team, opt-in). If you enable the design critique, the App resolves your PR’s already-public deploy-preview URL and sends it to our render service (Browserless), which loads that preview and captures screenshots. The screenshots are sent to Anthropic for the visual review. No additional repository content is read or sent.
3. What Anthropic does with it
The App calls Anthropic via the Vercel AI Gateway. Per Anthropic’s policy, API requests are not used to train models. Anthropic retains request data for a limited operational window (currently ~30 days for abuse monitoring); clud-bug does not access that buffer.
4. What we retain
We use Upstash Redis for configuration and short-lived operational state. None of it contains PR diffs or skill bodies.
| Class | Contents | TTL |
|---|---|---|
| Install config | Org login, tier / billing mode, skill-catalog config. | Until uninstall. |
| Idempotency keys | Webhook delivery IDs marked processed (prevents double-reviews). | ≤ 24 hours. |
| Usage + spend meters | Per-review token counts and cost estimates, for billing reconciliation. No content. | Short-lived (rolling). |
| Comment + screenshot cache | The review comment’s ID (to edit in place) and, for the design pass, screenshots keyed by commit SHA. | ≤ 1 hour (screenshots). |
We do not retain PR diffs after a review completes, skill manifest bodies (re-fetched each review), inline comment text (it lives in GitHub once posted), or authentication tokens (minted per-request and discarded).
5. Where the review is written
The review is posted to your PR: inline review threads at the exact lines, plus one summary comment that the bot edits in place on each new push (so the conversation stays to a single comment, not one per pass). That comment — in your GitHub repo, under the App’s identity — is the audit trail. We keep no copy of its text.
6. Sub-processors
| Sub-processor | Purpose | Region |
|---|---|---|
| Vercel | Function execution + logs | Multi-region (AWS) |
| Upstash | Redis (config + idempotency + meters) | Multi-region |
| Anthropic (via Vercel AI Gateway) | LLM inference for the review | US |
| Stripe | Subscription + metered billing | US |
| Browserless | Screenshot render for the visual design pass (Team, opt-in only) | US/EU |
| GitHub | The platform — install, webhooks, comment posting | Multi-region (Azure) |
We use no AI providers other than Anthropic. If that changes, this list is updated and installed customers are notified.
7. Logging
Vercel function logs capture request route + status, error stack traces, and operational lines (install ID, delivery ID, review outcome, policy denials). Logs do not contain PR diff content, skill bodies, or Anthropic responses. They age out per Vercel’s standard retention (7–30 days).
8. Data deletion
On uninstall: within 24 hours we purge all Redis keys tied to that installation. Idempotency keys age out within 24 hours regardless.
On request: open an issue at our GitHub Issues, or — for anything you’d rather not post publicly — a private security advisory. We respond within 7 business days.
9. Open source
The App’s codebase is open at github.com/thrillmade/clud-bug-app. Trace each data path above by searching the source for the storage key prefixes and the Anthropic call site.
10. Contact
Privacy questions, data-deletion requests, and security disclosures: GitHub Issues (public) or a private security advisory (confidential).