Privacy policy

1. Scope

This policy covers the public marketing site, the authenticated dashboard, and the Boson GitHub App. It does not cover third-party sites we link to or third-party services you connect to Boson, which are governed by their own privacy policies.

2. Information we collect

Account and sign-in information. You sign in to Boson with your Google account, through our authentication provider (Amazon Cognito). Boson never asks for or stores a password. We receive the basic profile information Google shares under the email, openid, and profile scopes: your name, email address, and Google account identifier. We do not request, and Google does not share, anything beyond that basic profile under this integration. Boson is invite only, so we keep a list of the Google email addresses allowed to sign in. When an address that is not on that list tries to sign in, we record the attempt, including the address, in our service logs for 7 days.

GitHub account and installation information. When your GitHub account or organization installs the Boson GitHub App, we receive your GitHub account or organization identifier, login name, and the list of repositories you chose to install the App on. We link this installation to your dashboard account so you can see reviews for repositories you have access to.

Pull request and code content. When a review is requested on a pull request in a repository where the App is installed, we process the changed files, diff content, and related repository context needed to produce that review. Section 4 explains how this content is handled.

Payment information. Paid plans are billed through Stripe. Stripe collects your payment card or other payment details directly; we do not receive or store your full card number on our own servers. We receive limited billing metadata from Stripe, such as your subscription status and the last four digits of your payment method, to reconcile invoices and manage your account.

Log and usage data. Our infrastructure automatically records request metadata (such as timestamps, endpoint, and status code) for operating and securing the Service, and we record which repositories requested reviews, when, and at what cost for billing and quota enforcement.

3. How we use information

• To operate, maintain, and secure the Service.
• To produce the review posted back to your pull request.
• To authenticate you, link your account to the correct GitHub tenant, and enforce per-account access.
• To process payments, calculate usage-based charges, and send billing communications.
• To enforce input limits and daily quotas before a review is ever queued.
• To provide support, respond to enquiries, and communicate service-related notices.
• To comply with legal obligations.

4. How pull request and code content is processed

A review runs only when explicitly requested, by commenting @useboson review on a pull request or triggering a review from the dashboard. The relevant diff and repository context are processed in an isolated review environment. To generate the review, Boson sends the relevant code and diff content to our large-language-model relay, OpenRouter, which routes the request to an underlying model provider.

Boson does not train its own models on your code, because Boson does not train models at all: it calls a third-party relay for each review. We do not currently offer a contractual zero-data-retention guarantee covering every model we route through; retention of content sent through OpenRouter is governed by OpenRouter’s and the relevant underlying model provider’s own policies, which can vary by model and change over time. If your organization requires a specific data-handling commitment for LLM processing, contact us before enabling the Service on a repository.

Boson posts findings back to the pull request as a single comment. Boson never approves a pull request and never requests changes on your behalf; a human always makes the merge decision.

To show a review in the dashboard and to answer replies to its comments, Boson stores the evidence excerpt, the claim, and the traced path of each finding it posts. We keep these for 90 days after the finding is posted and then delete them. The finding’s severity, file name, and line range stay, so your review counts remain accurate.

5. Data retention

We retain account, billing, and installation records for as long as your account is active and afterward as needed to comply with legal, tax, and accounting obligations. Operational infrastructure logs are retained for up to 30 days, and logs of sign-in attempts from addresses that are not on our invite list for 7 days, and are then deleted. The evidence excerpt, claim, and traced path of each posted finding are deleted 90 days after the finding is posted, as described in Section 4. We retain pull request and diff content only as long as needed to produce, deliver, and support a given review, and to enforce quotas and billing; we do not use it for any purpose beyond operating and improving the Service.

6. Subprocessors and third-party service providers

We share information with the following categories of service providers, each acting under its own terms and only to the extent needed to provide the Service:

• OpenRouter: large-language-model relay used to generate review findings from pull request content.
• Stripe: payment processing and billing.
• Amazon Web Services: hosting, authentication (Amazon Cognito), and supporting infrastructure.
• Cloudflare: content delivery and DNS for our public website.
• GitHub: the platform through which the GitHub App reads pull requests and posts review comments.
• PostHog: product analytics and session replay for the website and dashboard, hosted in the United States (see Section 8).

This list reflects the providers we use as of the date above and may change; material changes will be reflected in an updated version of this policy.

7. GitHub App access and permissions

Installing the Boson GitHub App grants Boson access, scoped to the repositories you select, to read pull request content needed to review it and to post a single comment back to that pull request. Boson does not approve pull requests or request changes. The exact permission grant is configured on the App and is always visible to you, and revocable by you, from your GitHub account or organization’s installed-App settings. Uninstalling the App immediately stops any future access to your repositories.

8. Cookies and analytics

We use PostHog, a product analytics service hosted in the United States, to understand how visitors use the website and how customers use the dashboard. We do not use advertising cookies, and we do not sell or share analytics data for advertising.

On the website, PostHog records page views, clicks, and how far you scroll, and may record a replay of your visit with every form input masked. Until you choose Accept on the cookie banner, PostHog stores nothing in your browser and counts visits using a hash computed on PostHog’s servers. If you choose Accept, it keeps a random identifier in a first-party cookie and in local storage so that repeat visits can be recognised. If you choose Decline, it keeps storing nothing.

In the dashboard, PostHog records the same kinds of events and keeps a random identifier in your browser’s storage, alongside the session tokens that keep you signed in. While you are signed in, your activity is linked to a pseudonymous identifier derived from your account and to your organization’s GitHub account id and name. Replays of dashboard sessions mask all text and every input, so pull request content, findings, and code are not recorded. We do not send your email address to PostHog.

PostHog receives your IP address and uses it to estimate an approximate location. Analytics events are kept for up to one year and session replays for up to 30 days.

9. Data security

We use encryption in transit for all Service traffic, signature verification on incoming webhooks, and least-privilege access controls that scope each internal service to only the data it needs. Tenants are isolated by installation, and every query is scoped to the requesting account. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. Your rights and choices

• You can update your account information from the dashboard.
• You can uninstall the GitHub App at any time from your GitHub settings to stop all further repository access.
• You can choose Decline on the website’s cookie banner, and PostHog will store nothing in your browser (see Section 8).
• You can request access to, correction of, or deletion of your personal information by contacting us using the details in Section 14.
• Depending on where you live, you may have additional rights under applicable data protection law; we will honour valid requests as required by that law.

11. International data transfers and hosting location

Boson is operated by an individual based in Canada. The control plane, authentication, and supporting infrastructure currently run on Amazon Web Services in the United States (US East region), so information you provide is transferred to and processed in the United States regardless of where you or the operator are located.

12. Children’s privacy

The Service is intended for business and professional use and is not directed to children. We do not knowingly collect personal information from anyone under the age of 16. If you believe a child has provided us with personal information, contact us and we will delete it.

13. Changes to this policy

We may update this policy from time to time. We will post the revised policy here and update the “Last updated” date above. If a change is material, we will make reasonable efforts to notify account holders. Continued use of the Service after a change takes effect constitutes acceptance of the revised policy.

14. Contact us

Questions about this policy, or requests regarding your information, can be sent to [email protected]. This policy is published by Sakib Sadman Shajib, the individual who operates Boson as a sole proprietorship in Canada.