Privacy policy

Account information

GitHub sign-in provides your name, username, profile image, email address, and account identifier. When email and password sign-in is available, Critic stores the submitted name and email address and an irreversible password hash. Critic also stores authentication sessions, connected-device identifiers, and the repository permissions associated with your account.

Repository and review information

For repositories you select, the GitHub App provides repository and pull request metadata, diffs, comments, reviews, checks, and installation permissions. The Critic bridge sends repository identity, patch content, local change snapshots, authored explanations, selected visual evidence, and Critic review discussion needed to provide the service.

Lifecycle hooks send the event type, a coding-agent session identifier, the working directory, and, after a tool runs, the tool name. Critic does not transmit or store your coding prompts, raw coding transcript, assistant final messages, tool arguments, tool results, or transcript file locations.

How Critic uses information

Critic uses this information to authenticate you, enforce repository access, synchronize code changes, publish explanations, route reviewer questions, prevent duplicate work, detect abuse, troubleshoot failures, and operate the service. Critic does not sell personal information or use private repository content to train general purpose models.

Service providers

Critic relies on GitHub for repository access, Convex for application data and realtime transport, and Vercel for web hosting and network delivery. When you ask a connected coding agent a review question, the local bridge sends the relevant Critic discussion and repository context to the coding-agent service you already use. That provider processes the request under your agreement with it.

Information may also be disclosed when required by law, to protect users or the service, to investigate abuse, or as part of a business transfer. Critic does not give a service provider permission to use private repository content for its own advertising.

Cookies and OAuth connections

Critic uses necessary cookies and similar credentials to keep you signed in, protect authentication requests, and remember security choices. A coding agent connects to the hosted publication tool with OAuth. Publication also requires a separate short-lived Critic checkpoint bound to your account, device, authoring session, target, and revision.

Retention and control

Critic retains account and change information while it is needed to provide the service and maintain durable review history. You can revoke the GitHub App, disconnect a coding agent, or request account deletion. A remote publication command and its staged content expire within 24 hours. Critic stores checkpoint capabilities only as one-way hashes. Local bridge credentials are stored under ~/.critic with user-only permissions and are removed when the bridge is disconnected.

Security

Critic uses scoped credentials, repository access checks, signed GitHub webhooks, encrypted network transport, and least-privilege local file permissions. No system can guarantee absolute security. Do not send secrets or private source code in a support request.

Your choices and contact

You may request access, correction, export, or deletion of your account information where applicable. Some review history may be retained when another authorized repository member needs it or when law requires retention. Send privacy and deletion requests to support@usefeyn.com.

Children and policy changes

Critic is a developer service and is not directed to children under 13. This policy may change as the service changes. Material updates will be posted here with a new effective date.