Privacy Policy

Last updated 21 August 2026

quellbot is a GitHub App that reads issues and pull requests you point it at and uses a Claude model to fix bugs, review PRs, and triage failed CI. This policy explains what data passes through the service and how it is handled. It applies to the hosted instance at quellbot.fly.dev; if you self-host, you are the data controller for your own instance.

1. What we process

Data	Why	Kept
GitHub identity (login, id, avatar)	To sign you in and map you to your installation	While your account exists
Repository content (issue text, PR diffs, CI logs, file contents needed for a change)	Read at run time to perform the fix, review, or triage you requested	Not stored after the run; only sent to the model to produce the result
Your Claude credential (API key or subscription OAuth token)	To call the model on your behalf, only through quellbot's budget gateway	Encrypted at rest until you disconnect it; never enters the sandbox
Your Fly.io API token	To start the ephemeral sandbox that runs your fix	Encrypted at rest until you disconnect it
Run metadata (repo, status, model, token counts, cost, timestamps)	To show your dashboard, enforce budgets, and debug	Retained for your history until you delete the account
Email (optional)	To send you health alerts (dead token, budget cap)	Until you remove it

quellbot does not store your source code, execute it on the control plane, or use your code or prompts to train any model.

2. Who we share it with (sub-processors)

To run the service, data passes through these providers. Each is used only for the function listed.

Anthropic - runs the model that produces fixes, reviews, and triage. Your prompts and the code they include are processed here. See Anthropic's commercial terms for their retention.
GitHub - the source of your repositories and the destination for the PRs and comments quellbot creates.
Fly.io - hosts the control plane and (on your token) the ephemeral sandbox that runs your fix.
Neon / PostgreSQL - stores account state, run metadata, and encrypted credentials.
Resend - sends alert emails, only if you provide an email.
Vercel - hosts this documentation site (static, no account data).

3. How your credentials are protected

Claude and Fly credentials are encrypted at rest and only decrypted in memory when needed for a run.
The fix sandbox is credential-free: it never receives your real Claude credential. It reaches the model through a single-run, budget-capped gateway token that is revoked when the run ends.
Every push a run produces passes a deterministic policy gate before it reaches your repository. quellbot never merges, never touches your default branch, and never edits your CI.

4. Your choices and rights

Disconnect anytime - remove your Claude or Fly credential in Connections, or uninstall the GitHub App to revoke repository access immediately.
Delete your data - request account deletion and we remove your account, credentials, and run history.
Access and export - request a copy of the run metadata we hold for you.
Depending on where you live (for example the EU/UK under GDPR, or California under CCPA), you may have additional rights to access, correct, or erase your data. Contact us to exercise them.

5. Data location and retention

The control plane and database run in the United States. Run metadata is kept for your dashboard history until you delete your account; credentials are kept until you disconnect them; repository content is not retained beyond the run that used it.

6. Children

quellbot is a developer tool and is not directed to anyone under 16. Do not use it if you are under the age required to hold a GitHub account in your country.

7. Changes

If this policy changes materially, we will update the date above and, where appropriate, notify account holders by email.

8. Contact

Questions or data requests: open an issue at github.com/abdulmunimjemal/quellbot or email the address listed on that repository.