Privacy policy

Who this policy covers

“Rocky Reviews,” “Rocky,” “we,” or “us” refers to the people operating the Rocky Reviews website and any hosted Rocky service. This policy covers information processed for those services. When you run Rocky on your own infrastructure, you or your organization operate that instance and decide how it handles information.

For privacy questions or requests, email hello@rockyreviews.dev.

Information from the website

When you load this website, the systems that deliver it may process ordinary request details such as the page requested, time of request, browser information, referring page, and network address. This can be used to deliver the site, protect it, and investigate service problems.

If you email us, we receive the address and message you choose to send so we can respond. The site currently loads typefaces from Google Fonts, which means your browser requests font files from Google. We do not currently use advertising or audience analytics scripts on this website.

Information used for code review

If you connect a GitHub account or ask the hosted service to review a pull request, Rocky needs to process account and workspace details, repository and pull request metadata, changed files and code context, review findings, and the actions you take on those findings. The information processed depends on the features you use and the access you grant.

To generate an AI review, the relevant code context and instructions are sent to the model provider configured for that review. With BYOK, you provide the provider key and that provider bills you directly. A request made through Rocky’s hosted service may still pass through Rocky’s systems to reach the provider. With managed AI, Rocky arranges model access and charges for usage through prepaid credits. The model provider also processes the submitted context under its own terms and privacy practices.

Billing and service administration may involve contact details, plan selection, credit balance, usage totals, invoices, and payment status. Do not send secrets or personal information in code or prompts unless you are authorized to do so.

Why information is used

Information is used to provide requested reviews, maintain accounts and integrations, calculate usage, respond to support requests, secure and troubleshoot the service, prevent abuse, and meet applicable legal obligations. Where privacy law requires a legal basis, the basis depends on the context and may include providing a requested service, legitimate interests in operating and protecting it, consent, or a legal obligation.

Sharing and service providers

Information is shared with the GitHub and model services needed for the features you enable, and with infrastructure or billing providers needed to operate a hosted service. Those providers process information under their own terms and may operate in other countries. We do not currently use this website to sell personal information or to serve targeted advertising.

When you self host Rocky, your organization selects the infrastructure and model providers. Their handling of data is governed by your configuration and agreements with them, rather than by this website’s hosting practices.

Retention and security

Information is kept for as long as needed to provide the relevant feature, support the account, maintain security, resolve disputes, and meet legal or accounting duties. The exact retention period depends on the hosted feature and its deployment. We do not publish a single fixed retention period for hosted pull request content in this policy. Contact us before connecting a repository if you need details for a particular deployment.

We use measures intended to protect information, but no internet transmission or storage system can be guaranteed completely secure. Self hosted operators are responsible for securing their own installation, credentials, backups, and provider connections.

Your choices and privacy rights

You can choose whether to use the website, what information to send us, which repositories to connect, which model provider to use, and whether to self host. Depending on the law that applies to you, you may have rights to request access, correction, deletion, restriction, or a copy of personal information, or to object to certain processing. Email hello@rockyreviews.dev to make a request. We may need to verify your identity and coordinate with the account owner when a request concerns organization data.

Changes to this policy

We may update this policy as Rocky changes. The date at the top shows when it was last revised. If a change materially affects how information is handled, we will take reasonable steps to provide notice through the service or this website.