dev: pull request

docs/privacy-policy.md

@@ -0,0 +1,223 @@
+# PRNote Privacy Policy
+
+**Effective date:** July 22, 2026
+**Last updated:** July 22, 2026
+
+PRNote (“PRNote,” “we,” “us,” or “our”) provides a GitHub App that generates pull request titles and descriptions from pull request metadata, commit history, changed files, and selected code changes.
+
+This Privacy Policy explains what information PRNote accesses, how it is used, when it may be shared, how long it is retained, and the choices available to users.
+
+## 1. Information PRNote Accesses
+
+When PRNote is installed on a GitHub account or organization, it may access information permitted by the GitHub App installation, including:
+
+* GitHub account or organization identifiers
+* GitHub App installation identifiers
+* repository names and identifiers
+* pull request titles and descriptions
+* source and target branch names
+* commit messages
+* changed filenames
+* file-change statistics
+* selected portions of pull request diffs
+* installation, repository-access, and webhook event information
+* configuration stored in files such as `.github/prnote.yml`
+
+PRNote accesses only repositories selected during installation or later granted to the App.
+
+## 2. GitHub Permissions
+
+PRNote may request the following repository permissions:
+
+* **Metadata: Read**
+* **Contents: Read**
+* **Pull requests: Read and write**
+
+These permissions allow PRNote to read relevant pull request context and update pull request titles and descriptions.
+
+PRNote does not use its GitHub App permissions to modify repository source files.
+
+## 3. How We Use Information
+
+PRNote uses accessed information to:
+
+* generate pull request titles and descriptions
+* identify weak, empty, or template-only pull request content
+* preserve meaningful content written by pull request authors
+* process GitHub webhook events
+* apply repository-specific configuration
+* prevent duplicate processing
+* diagnose failures and maintain service reliability
+* measure basic product usage and enforce service limits
+* protect the service against misuse and abuse
+
+We do not sell repository data or personal information.
+
+## 4. Artificial Intelligence Processing
+
+PRNote may send limited pull request context to an external AI service to generate pull request documentation.
+
+The information sent may include:
+
+* pull request metadata
+* commit messages
+* changed filenames
+* selected code-change excerpts
+* existing pull request content
+
+PRNote is designed to minimize the amount of source-code content sent for generation. Lockfiles, generated files, build output, and other low-value files may be excluded.
+
+**Current AI provider:** [INSERT PROVIDER NAME]
+
+Use of an external AI provider is also subject to that provider’s applicable privacy and data-processing terms.
+
+PRNote does not intentionally use customer repository content to train PRNote-owned machine-learning models.
+
+Replace this section if your provider stores prompts, uses data for model improvement, or offers configurable retention.
+
+## 5. Information We Store
+
+PRNote may store:
+
+* installation and repository identifiers
+* installation status
+* repository configuration
+* webhook delivery identifiers
+* generation-job status
+* timestamps
+* error and operational logs
+* usage counts
+* subscription or Marketplace-plan information
+
+PRNote may temporarily store pull request context while a generation request is processed.
+
+PRNote does not intentionally store complete repository copies.
+
+## 6. Data Retention
+
+PRNote retains information only for as long as reasonably necessary to provide and protect the service.
+
+Current retention periods:
+
+* installation and repository records: while the App remains installed
+* configuration and plan records: while the account remains active
+* webhook delivery identifiers: [INSERT RETENTION PERIOD]
+* operational and error logs: [INSERT RETENTION PERIOD]
+* generation input and output: [INSERT RETENTION PERIOD OR “not retained after processing”]
+* backups: [INSERT BACKUP RETENTION PERIOD]
+
+When PRNote is uninstalled, associated installation records are deleted or anonymized within [INSERT NUMBER] days, except where retention is required for security, legal, accounting, or dispute-resolution purposes.
+
+## 7. Information Sharing
+
+PRNote may share information only with service providers needed to operate the product, such as:
+
+* GitHub, for App installation, authentication, webhook delivery, and API access
+* the configured AI provider, for generation
+* cloud hosting providers
+* database, queue, monitoring, and logging providers
+* payment or GitHub Marketplace services, when applicable
+
+These providers receive information only as needed to perform services on our behalf.
+
+We may also disclose information when required by law, to protect legal rights, investigate abuse, or protect the security of users and the service.
+
+## 8. Security
+
+PRNote uses reasonable technical and organizational safeguards intended to protect information, including:
+
+* GitHub App installation tokens with limited lifetimes
+* webhook-signature verification
+* encrypted network connections
+* restricted access to production credentials
+* secret management for private keys and API credentials
+* least-privilege GitHub permissions
+* logging and monitoring of service failures
+
+No internet service or storage system can guarantee absolute security.
+
+## 9. Private Repositories
+
+If PRNote is installed on a private repository, PRNote may process information from that repository only within the permissions granted by the installer.
+
+Repository administrators should review PRNote’s permissions, AI-provider usage, and internal policies before installing PRNote on repositories containing confidential, regulated, or highly sensitive information.
+
+## 10. User and Organization Responsibilities
+
+The person installing PRNote is responsible for:
+
+* having authority to install the App
+* selecting appropriate repositories
+* informing repository contributors when required
+* ensuring that use of PRNote complies with organizational policies
+* avoiding submission of secrets, credentials, personal data, or regulated information through pull request content when such processing is not permitted
+
+## 11. Your Choices and Rights
+
+Depending on your location, you may have rights concerning personal information, including the right to:
+
+* request access
+* request correction
+* request deletion
+* object to or restrict certain processing
+* request data portability
+* withdraw consent where consent is the legal basis for processing
+* submit a complaint to an applicable data-protection authority
+
+To submit a request, contact us using the information below.
+
+We may need to verify your identity and authority over the relevant GitHub account or organization.
+
+## 12. Uninstalling PRNote
+
+You can stop PRNote’s access by:
+
+* removing selected repositories from the App installation
+* suspending the GitHub App installation
+* uninstalling PRNote from the GitHub account or organization
+
+After uninstallation, PRNote will no longer receive new repository webhook events for that installation.
+
+Requests for deletion of previously stored information may be sent to the contact address below.
+
+## 13. Children’s Privacy
+
+PRNote is intended for software-development and professional use. It is not directed to children, and we do not knowingly collect personal information from children below the minimum legal age applicable in their jurisdiction.
+
+## 14. International Processing
+
+PRNote and its service providers may process information in countries other than the country where a user is located.
+
+Where legally required, we will use appropriate safeguards for international transfers of personal information.
+
+## 15. Changes to This Policy
+
+We may update this Privacy Policy as PRNote changes.
+
+When material changes are made, we will update the “Last updated” date and may provide additional notice through the repository, product website, GitHub Marketplace listing, or another appropriate channel.
+
+Continued use of PRNote after an updated policy becomes effective means the service will be governed by the updated policy, subject to applicable law.
+
+## 16. Contact
+
+For privacy questions, requests, or complaints, contact:
+
+**PRNoteWorks**
+**Email:** [INSERT PRIVACY OR SUPPORT EMAIL]
+**GitHub organization:** https://github.com/PRNoteWorks
+**Website:** [INSERT WEBSITE URL]
+**Country or region:** [INSERT COUNTRY OR REGION]
+
+## 17. Subprocessors
+
+PRNote currently uses or may use the following service providers:
+
+| Provider              | Purpose                                                               | Data potentially processed                                             |
+| --------------------- | --------------------------------------------------------------------- | ---------------------------------------------------------------------- |
+| GitHub                | App installation, authentication, webhooks, and repository API access | GitHub account, repository, installation, and pull request information |
+| [AI PROVIDER]         | Generate pull request titles and descriptions                         | Selected pull request and code-change context                          |
+| [HOSTING PROVIDER]    | Host the PRNote service                                               | Requests, operational data, and logs                                   |
+| [DATABASE PROVIDER]   | Store installation and configuration data                             | Installation, repository, configuration, and usage records             |
+| [MONITORING PROVIDER] | Error monitoring and service reliability                              | Error messages, request metadata, and limited technical context        |
+
+This list should be updated whenever PRNote adds or removes a provider.