Privacy

The code you paste, or the diff fetched for the pull request you named, is sent to this site's server as the message of one agent turn. The server sends each file to Jev, TypeSafe's evaluation model, through the Vercel AI Gateway, to be answered against 34 questions. It then sends Jev's findings and that file's text to Luna (openai/gpt-5.6-luna-fast), through the same gateway, to be written up as the review you read.

That is the whole path. Your code reaches the Vercel AI Gateway and the two model providers behind it, and nothing else. At most 24 code files go out in a turn, each cut to 16,000 characters, with up to 10 prose files shown beside them and never sent to be judged.

Code can also arrive from an agent rather than from a browser tab, through the MCP server at https://clean-code-review.vercel.app/api/mcp. That path sends the code on the same route to the same two models, in one request, with no session and no tab. It keeps what the page keeps and nothing more: the same one-hour cache of answers and reviews, and a count of calls per network address, 10 per 10 minutes, held in one server instance's memory for that window.

The site has a model budget that every visitor shares: $0.40 per hour and $1.00 per UTC day, and it pauses reviews once that is spent, until it resets. The MCP server has its own, $0.25 per hour and $1.00 per UTC day, and refuses new reviews once it is spent. Each budget is a running total of what the models cost, and holds nothing about who asked.

Each browser tab holds one agent session. The page clears that session's history before every turn, so the only code it holds is the code being judged right now. Closing the tab retires the session, and a session left alone expires after an hour.

Answers are cached for one hour, keyed by a hash of exactly what was judged, so that judging the same file twice costs one evaluation rather than two. That cache holds the code that was judged and the answers that came back, it is per deployment region, and it expires on its own. It is keyed by the content and by nothing about you. A review that arrives from it is the one marked "from cache".

Public repositories only. The server fetches the pull request from GitHub with no credentials of yours and none are ever asked for. The deployment may hold a GitHub token of its own, which raises this site's rate limit with GitHub and grants no access a signed-out visitor would not have.

Fetching is rate limited per network address: 20 pull requests per 10 minutes. That address is the one thing about a visitor this site's own server holds at all. It is held in one server instance's memory, for that window, to decide whether to fetch again, and it is never written anywhere else.

This site counts page views with Vercel Web Analytics. A small script from Vercel, served from this site's own domain, sends a record to Vercel each time a page is opened, including a review opened without reloading the page. Nothing else is sent: not a click, not the code you paste and not a review.

Each record carries the address and the route of the page, the address of the page that linked here if it is on another site, a location worked out from the request (such as the country, region and city), the browser and its version, the operating system and its version, the device type, the version of the script, and the time. The linking page's address is sent as your browser gives it, which this site does not change.

This site's own addresses are cleaned before they are sent. The home page, /faq and /privacy go as they are. A review opened from a pull request, and any other address under a repository's /pull, goes as /[owner]/[repo]/pull/[number], so the record says that a review was read and not which one. Any other address can only be a page that does not exist, and goes as /[not-found]. None of them carries its query or fragment.

The script sets no cookie and stores nothing in your browser. To tell visitors apart, Vercel makes a hash from the incoming request instead, and resets it after a day, so a visitor cannot be followed from one day to the next or from this site to another. Vercel describes the records as anonymous: they are not tied to a person or to a network address. Vercel keeps them for at least the reporting window of this site's plan, one month on the free plan and one or two years on paid ones, and says it may keep them longer.

Vercel's own account of what Web Analytics collects.

This site measures how fast its pages load for the people using them, with Vercel Speed Insights. A small script from Vercel, served from this site's own domain, reads the loading and responsiveness timings the browser already keeps (the Web Vitals) and sends them to Vercel as the page is used and when it is left.

Each measurement carries the timing and its value, the address and the route of the page it was taken on, the page element it concerns, the browser and its version, the device type and operating system, the network speed the browser reports, the country, the version of the Speed Insights script, and the time Vercel received it. The address and the route are cleaned the same way as for page views, so each is one of the three pages, /[owner]/[repo]/pull/[number] or /[not-found], with no query or fragment. The responsiveness timing also names the kind of input it measured, such as a tap or a key press, along with the element.

The element is named by a short selector the script builds from tag names, style class names and at most one id, such as main>img or #file-3>div.flex. No id or class on this site carries a file name, a repository or words from a pull request: the file cards are numbered, and the ids and code-language classes a pull request's description would bring are renumbered or dropped. Code you paste, the names of the files and the reviews are never part of a measurement.

The script sets no cookie and stores nothing in your browser. Vercel describes the measurements as anonymous: they are not tied to a visitor or to a network address, and nothing in them would let anyone follow one visitor from page to page or say who they are. Vercel does not publish how long it keeps them. The dashboard this site's owner reads them in shows the last seven days, or longer on Vercel's paid tier.

Vercel's own account of what Speed Insights collects.

No sign-in and no profile. No database. No cookies and no local storage beyond the light or dark setting this page remembers for you. No advertising and no tracking pixels, and nothing that records who visits: the page views and page speed above are counted without saying who you are. Nothing is sold, because there is nothing collected to sell.

The whole application is open source, so none of the above has to be taken on trust. Read the code.