Privacy Policy

Last updated: July 20, 2026

PRBoard collects the minimum it needs to show you your pull requests, and nothing shady happens with it. Here are the specifics.

Who is responsible for your data

PRBoard (https://prboard.dev) is operated by Yuya Iwabuchi, a solo developer based in Canada, who is the accountable contact for privacy matters: yuya.iwabuchi@gmail.com.

What we collect

• GitHub account identity — your username, display name, avatar, and numeric GitHub ID, obtained when you sign in with GitHub.
• GitHub access tokens — the OAuth token from the PRBoard GitHub App, and an optional personal access token if you choose to add one. Tokens are stored encrypted at rest (AES-256-GCM) and are used solely to sync your PR data from GitHub. Nothing else.
• Pull-request metadata visible to your GitHub account — titles, authors, reviewers, review and CI status, timestamps, and similar fields needed to build your board.
• Billing email — only if you upgrade to Pro; it's passed to Polar (our payment processor and Merchant of Record) for receipts and subscription management.
• Operational telemetry — sync timing and counters, so we can keep the service healthy.
• Invite-request info — if you submit a request for an invite, the email address you provide (required) and, optionally, your GitHub username.

What we don't do

• We don't sell your data. Ever.
• We don't run ads.
• We don't use third-party tracking cookies.
• We never store your source code. PRBoard syncs PR metadata only — file contents and diffs are not stored.

Cookies and analytics

PRBoard sets exactly one cookie: prboard_session, a signed, strictly-necessary session cookie that keeps you logged in (maximum lifetime 30 days). That's it.

Analytics come from Vercel Web Analytics, which is cookieless and reports aggregate page statistics without identifying individual visitors.

Service providers (subprocessors)

We use a small set of providers to run PRBoard. Each receives only what it needs:

International transfers

PRBoard's data is processed in the United States by the providers above. If you're outside the US (including in the EU/EEA, UK, or Canada), your data is transferred there to run the service, protected by the safeguards described in this policy and our providers' own commitments.

How long we keep data

• Account data (identity, tokens, PR metadata) is kept while your account exists.
• Done-PR history drops off your board after your configured age-out window (default 2 days, up to 3), and the underlying records are deleted shortly after.
• Account deletion: email us and we'll delete your account and associated data. Billing records held by Polar are subject to Polar's own retention obligations (tax and accounting law).

Security

Access tokens are encrypted at rest with AES-256-GCM. All traffic uses TLS in transit. Access to production systems is limited to the operator.

If a data breach affects your personal information, we will notify affected users without undue delay, along with what happened and what we're doing about it.

Your rights

Wherever you live, you can ask us to:

• Access the personal data we hold about you,
• Correct it,
• Delete it,
• Export it in a portable format.

Email yuya.iwabuchi@gmail.com and we'll respond within 30 days. These rights reflect Canada's PIPEDA and, for EU/EEA and UK users, the GDPR (including the rights to restrict or object to processing, and to complain to your local supervisory authority).

Legal bases (GDPR)

• Contract performance — syncing and displaying your PRs is the service you signed up for.
• Legitimate interest — abuse prevention and operational telemetry that keeps the service running.
• Consent — where applicable, such as optional features you explicitly enable; you can withdraw consent at any time.

Children

PRBoard is not directed at children under 16, and we don't knowingly collect their data. (You also need a GitHub account to use it.)

Changes to this policy

If this policy changes materially, we'll announce it on the site and update the date at the top. Continued use after changes take effect means you accept the updated policy.

Contact

Privacy questions, data requests, or anything else: yuya.iwabuchi@gmail.com.