Privacy policy

01Who we are

PatchLabs (“we”, “us”) runs patchlabs.dev and api.patchlabs.dev. PatchLabs is run by Manraj Singh Dhillon in London, United Kingdom, who is the data controller for the personal data described here. Contact: manraj@patchlabs.dev.

Where you use PatchLabs on behalf of a business, and your repo contains personal data that business controls, we act as its processor under our data processing terms.

02What we collect

When you start a free check

• Your email address and the GitHub repo you want checked.
• A one-time verification code we generate, and the repo’s default branch.
• A salted, shortened hash of your IP address, used only to limit how many checks one network can start. We never store the raw address.

When you use the free RLS check

The repo you entered and the same salted IP hash, so we can limit each network to 20 checks an hour and spot abuse. Results are cached for 10 minutes.

When you create an account

• Your email address and, if you add one, your name.
• Your workspaces, roles and plan; invitations you send (including the invitee’s email address).
• Apps you monitor, their schedules, client labels and badge settings; your webhook URL.
• Hashes of your sign-in links, sessions and API keys (never the originals).
• Decisions and answers you record on a report, with your name (or email if you have no name) shown as the person who made them.

What a check produces

• The report, the fix (a SQL migration and any code notes), a signed receipt, and a log of events (for example “verified”, “email sent”).
• Exposed keys found in your code or git history are recorded only in masked form.

When you email us

Your email address, your message and anything you attach.

When you visit the website

• We set no cookies and run no analytics or trackers. See the cookie notice.
• Your browser stores up to two items in localStorage: pl_session (only while you’re signed in) and pl_theme (only if you choose a theme).
• The website is hosted on GitHub Pages, which keeps standard request logs (including IP addresses) under GitHub’s own privacy statement.
• Fonts load from Google Fonts, and the report page loads two open-source libraries from cdnjs (Cloudflare). Those services receive your IP address and browser details when the files load.

03Your code

We read the repository you submit, the same way anyone can read a public repo on GitHub. A working copy is cloned to our worker machine, where we rebuild your database from its migrations in a disposable lab seeded with fake rows. Checks never connect to your live app or database, and we never ask for your database password.

Live posture (optional). For a domain you verify, we load its public home page once a day, the way any visitor’s browser does, and keep the grade, findings, response headers, certificate details and the names and flags of any cookies it sets (not their values), until you remove the domain. The free headers check loads one public page you enter and stores no result; only a hashed network address is kept for rate limiting.

The relevant parts of your code, migrations and lab results are sent to Anthropic’s Claude models to write the fix and the report. The lab database is deleted as soon as the check finishes; the working copy and run files are deleted within 30 days.

If your repo itself contains personal data (for example, real emails in a seed file), we process it only as part of the check, and it is covered by the same retention rules.

04Why we use it, and our lawful basis

We don’t use your data for advertising, we don’t sell it, and we don’t make decisions about you based solely on automated processing that have legal or similarly significant effects.

05Who we share it with

Only the companies that help us run PatchLabs, each for one job:

If you add a webhook, we send check results to the URL you choose. Members of your workspace see the workspace’s apps, reports, decisions and answers. Anyone with a report link can open that report, so share links with care. We may disclose data if the law requires it, and we will tell you unless we are legally prevented.

06International transfers

Some of these providers process data outside the UK, including in the United States. Where that happens we rely on UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework where the provider participates) or on the UK International Data Transfer Addendum to the EU standard contractual clauses. Ask us for details of the safeguard used for a particular provider.

07How long we keep it

When you delete your account we delete your user record, sessions, any workspace you solely own (with its apps, checks and API keys), and checks you started without an account using the same email address. In decisions you made on shared workspaces, your name is replaced with “a former member”.

08Your rights

Under UK GDPR you have the right to:

• access the personal data we hold about you;
• correct it if it’s wrong;
• delete it;
• restrict or object to how we use it, including processing based on legitimate interests;
• take it with you in a machine-readable format (portability);
• withdraw consent where we rely on it.

Do it yourself: when signed in, Settings lets you export everything as JSON (GET /me/export) or delete your account (DELETE /me). Or ask us: email manraj@patchlabs.dev. We reply within one month, and we may ask you to confirm the request from the email address we hold.

Complaints. Please contact us first so we can try to fix it. You also have the right to complain to the UK Information Commissioner’s Office (ICO): ico.org.uk/make-a-complaint, telephone 0303 123 1113.

09Children

PatchLabs is a tool for people who build software and is not directed at children. Don’t use it if you are under 16.

10How we protect it

Tokens and keys are stored only as hashes, traffic is encrypted in transit, the lab is disposable and the fix agent runs with narrow permissions. The full picture is on our security page.

11Changes

If we change this policy in a way that matters, we’ll update the date at the top and email account holders before the change takes effect.

12Contact

PatchLabs, London, United Kingdom
manraj@patchlabs.dev