Privacy policy
Spine is an iPhone app for reviewing GitHub pull requests, made by Landon C., an independent developer. This policy says what Spine collects, why, where it goes and how long it's kept. The short version: Spine reads your code to build its reading aids, but it never stores source code on its servers.
What Spine stores on its servers
- Your GitHub identity: your GitHub user ID and login. Spine doesn't collect your email address, name or avatar.
- Sign-in: GitHub's refresh token for your account, encrypted with Google Cloud KMS, and a hash of each phone's session token. Your short-lived GitHub access token stays on your phone.
- Pull requests you review: each PR's repository, number, head commit, author and reviewers as GitHub IDs, and who it's waiting on. Spine doesn't store titles, descriptions or comments.
- Reading aids ("bundles"): for each push, file paths, symbol names and their positions, where symbols are used, chapter names and an AI summary. A bundle holds no source code, and only the PR's author and reviewers can download it.
- Your choices and account state: whether you allowed AI, your organizations' AI setting, your subscription's product, period and expiry as reported by RevenueCat, and your phone's push-notification token.
- Costs: what each analysis cost to run, per user, so Spine can enforce its monthly limits.
How your code is used
When a pull request you review gets a push, Spine's server fetches its changes from GitHub, analyzes them in memory and keeps only the derived results above. The code itself is discarded when the job ends.
Your phone downloads the files it shows you directly from GitHub, using your own GitHub token, and caches them on the phone.
AI
With your permission, asked once when you first sign in, Spine sends part of each pushed pull request to Anthropic's Claude model, which titles, orders and summarizes its chapters. That part is the PR's title, its description (up to 3,000 characters), file paths, symbol names and the changed lines, within a fixed size limit. Spine keeps only the model's output.
Anthropic processes this data under its commercial terms, which don't let it train its models on it, and keeps it only for a limited time under its standard retention policy. Spine has asked Anthropic for zero data retention, and this section will say so once it's in place.
You can turn AI off at any time in Settings. An organization's admin can turn it off for all of that organization's repositories. A pull request is shared by its author and reviewers, so its code can still reach the model when another of them allowed AI. The organization's switch is the one setting that stops it for everyone.
What stays on your phone
- Your session and GitHub tokens, in the iOS Keychain.
- Your review progress per hunk, your place in each PR and unsent comment drafts, in a local database.
- Downloaded bundles and source files, cached for up to 30 days and protected by iOS file encryption.
What Spine does on GitHub for you
Only when you act: it adds your comments to your pending review, deletes drafts you remove, submits your review and marks files as viewed once you've finished all their changes. These calls go from your phone with your token.
Analytics and crash reports
Spine identifies you to these services by a random ID that says nothing about your GitHub account. They never receive code, file names, repository names or PR titles.
- PostHog (United States) receives usage events with counts and timings: for example, that a PR was opened in chapter order, how many hunks were finished, or that a review was submitted. It also receives app open and close events. Session replay, screen views and tap tracking are off.
- Sentry (United States) receives crash and error reports, without screenshots, view hierarchies, breadcrumbs or IP addresses.
Who processes data for Spine
| Service | What for |
|---|---|
| Google Cloud (United States, us-central1) | Spine's servers, database and storage |
| Anthropic | AI chapters and summaries |
| GitHub | Sign-in, and the pull requests themselves |
| Apple | Purchases and push notifications |
| RevenueCat | Subscription status |
| PostHog | Usage analytics |
| Sentry | Crash and error reports |
Spine doesn't sell your data or use it for advertising.
How long data is kept
- Bundles: 30 days.
- Pull requests: deleted 400 days after they close.
- Sessions: deleted after 90 days unused. Phone push tokens: after 180 days.
- Webhook records and subscription events: 7 days.
- Your account: until you delete it. Database backups expire on their own schedule.
Your choices
- Turn AI off in Settings at any time.
- Signing out removes that phone's session and its tokens. Your encrypted GitHub refresh token stays on Spine's servers until you delete your account, or until you revoke Spine in GitHub's settings.
- Delete your account in Settings, under Delete account. Spine deletes your account and everything tied to it from its servers: your identity, refresh token, sessions, push tokens, subscription status, AI choice and costs. It removes Spine from your authorized apps on GitHub, and deletes your review progress, bundles and cached files from the phone. Pull requests you took part in keep your GitHub user ID as their author or reviewer for the other people on them, until those PRs are deleted 400 days after they close. RevenueCat, PostHog and Sentry keep their records under your random ID, which no longer points to any account. An App Store subscription continues until you cancel it.
- Manage or cancel your subscription in iOS Settings, under your Apple ID.
Changes and contact
If this policy changes, the new version will be posted here with its date. Questions go to support@spinepr.app.