Privacy Policy

Last updated: September 6, 2026

PRBoard collects the minimum it needs to show you your pull requests and to reach you about your account, and nothing shady happens with it. Here are the specifics.

Who is responsible for your data

PRBoard (https://prboard.dev) is operated by Yuya Iwabuchi, a solo developer based in Canada, who is the accountable contact for privacy matters: support@prboard.dev.

What we collect

• GitHub account identity — your username, display name, avatar, and numeric GitHub ID, obtained when you sign in with GitHub.
• GitHub access tokens — the OAuth token from the PRBoard GitHub App, and an optional personal access token if you choose to add one. Tokens are stored encrypted at rest (AES-256-GCM) and are used solely to sync your PR data from GitHub. Nothing else.
• Pull-request metadata visible to your GitHub account — titles, authors, reviewers, review and CI status, timestamps, and similar fields needed to build your board.
• Email address — your primary verified GitHub address, read from GitHub when you sign in. If you upgrade to Pro you may instead provide a billing address at checkout. Either address is passed to Polar (our payment processor and Merchant of Record) only when you subscribe, for receipts and subscription management.
• Team memberships — the GitHub teams you belong to, so a PR your team is asked to review reaches its own group on your board.
• Connected organizations — the login and avatar of each organization the token you added can reach, listed on the Connections screen.
• Operational telemetry — sync timing and counters, so we can keep the service healthy.
• Product usage events — which features you use (board views, sync completions, checkout steps and similar), linked to your internal PRBoard account id rather than your GitHub identity.

What we don't do

• We don't sell your data. Ever.
• We don't run ads.
• We don't use third-party tracking cookies.
• We never store your source code. PRBoard syncs PR metadata only — file contents and diffs are not stored.

Cookies and analytics

PRBoard sets two strictly-necessary cookies, and no others: __Host-prboard_session, a signed session cookie that keeps you logged in (maximum lifetime 30 days), and __Host-prboard_oauth_state, a short-lived random value used only to protect the GitHub sign-in itself, discarded as soon as you land back on PRBoard. No advertising or tracking cookies.

Analytics come from Vercel Web Analytics, which is cookieless and reports aggregate page statistics without identifying individual visitors. Alongside it, product-usage events — things like board views, sync completions, and checkout steps — are sent to PostHog (EU-hosted) so we can see which parts of PRBoard actually get used. These events are tied to your internal PRBoard account id, not your GitHub identity, they set no cookies, and PostHog is configured not to store IP addresses.

Service providers (subprocessors)

We use a small set of providers to run PRBoard. Each receives only what it needs:

International transfers

PRBoard's data is processed in the United States by the providers above, apart from product-usage events, which transit our US-hosted infrastructure and are stored and processed by PostHog in the EU. If you're outside the US (including in the EU/EEA, UK, or Canada), your data is transferred there to run the service, protected by the safeguards described in this policy and our providers' own commitments.

How long we keep data

• Account data (identity, tokens, PR metadata) is kept while your account exists.
• Done-PR history drops off your board after your configured age-out window (default 2 days, up to 3), and the underlying records are deleted shortly after.
• Account deletion: email us and we'll delete your account and associated data — your PR views, sections, sync history, and the account record itself. Billing records are subject to retention obligations (tax and accounting law): those held by Polar under Polar's policy, and the customer reference we keep to match your subscription to your account.

Security

Access tokens are encrypted at rest with AES-256-GCM. All traffic uses TLS in transit. Access to production systems is limited to the operator. Every GitHub App permission PRBoard requests, and why, is on the Security page.

If a data breach affects your personal information, we will notify affected users without undue delay, along with what happened and what we're doing about it.

Your rights

Wherever you live, you can ask us to:

• Access the personal data we hold about you,
• Correct it,
• Delete it,
• Export it in a portable format.

Email support@prboard.dev and we'll respond within 30 days. These rights reflect Canada's PIPEDA and, for EU/EEA and UK users, the GDPR (including the rights to restrict or object to processing, and to complain to your local supervisory authority).

Legal bases (GDPR)

• Contract performance — syncing and displaying your PRs is the service you signed up for.
• Legitimate interest — abuse prevention, operational telemetry that keeps the service running, and holding your email address so we can reach you about your account (service notices, security or incident notifications, and changes that affect you). You can object to this at any time, and you can ask us to erase the address without closing your account.
• Consent — where applicable, such as optional features you explicitly enable; you can withdraw consent at any time.

Children

PRBoard is not directed at children under 16, and we don't knowingly collect their data. (You also need a GitHub account to use it.)

Changes to this policy

If this policy changes materially, we'll announce it on the site and update the date at the top. Continued use after changes take effect means you accept the updated policy.

Contact

Privacy questions, data requests, or anything else: support@prboard.dev.