GitHub profile information
We may collect your GitHub username, account identifier, avatar, organization membership, and other profile information made available through the GitHub integration.
Privacy Policy.
This policy explains what data Permission Protocol collects, how it is used, and how to contact us about privacy requests. Effective March 18, 2026.
Privacy Snapshot
Permission Protocol collects only the information needed to operate GitHub-based approval workflows, maintain an audit trail, and improve the product. We do not position the service for children under 13.
For our compliance roadmap and subprocessors, visit /trust.
Privacy Contact
What We Collect.
The service is built around repository integrations, pull request context, and recorded approval decisions.
Repository metadata
We collect repository names, installation identifiers, branch settings, environment mappings, and status-check configuration needed to provide the service.
Pull request and approval data
We process pull request metadata, commit identifiers, approval decisions, reviewer identity, authority receipts, and related workflow events.
How We Use Data.
Collected information is used to operate the product, preserve authorization history, and understand product performance.
Provide the service, including approval routing, authority receipts, and audit trails.
Secure the platform, detect abuse, and troubleshoot integration issues.
Measure product usage and performance through internal analytics and PostHog.
Retention and Processors.
We retain data for service delivery, security, and auditability, and rely on a small set of third-party providers.
Data retention
We keep repository, PR, and approval records for as long as needed to operate the service, satisfy contractual obligations, resolve disputes, and maintain security and audit logs.
Third-party services
We use GitHub for repository integrations and authentication context, and PostHog for product analytics and usage measurement.
Cookies
We may use cookies or similar technologies to support sessions, remember preferences, and understand aggregate traffic patterns on the site and product surfaces.
Your Rights.
Depending on applicable law, you may be able to request access to or deletion of your personal data.
Access
You may request access to personal data we hold about you.
Deletion
You may request deletion of personal data, subject to legal, security, and audit-retention requirements.
Children's privacy
Permission Protocol is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided personal information, contact us at [email protected].