Privacy Policy

Last updated: October 13, 2026

The short version

  • The open source CLI, MCP server and GitHub Action run on your machine or in your CI. They send nothing to Buoy unless you turn on telemetry or sign in to sync.
  • The GitHub App reads your pull requests and repository files through GitHub and scans them on Cloudflare.
  • We store findings, not files: the file path, line and flagged value, plus the original and suggested line for each fix Buoy posts.
  • Findings are deterministic. Some review prose is written by an LLM through OpenRouter, which receives diff excerpts and file history. Details.
  • We do not sell your data or use it to train models. Every company that processes it for us is in the subprocessor list.

This policy is from Buoy Design, Inc. ("Buoy," "we," "us") and covers the open source tools, the GitHub App, the dashboard and buoy.design.

Open source tools

  • CLI and MCP server: scan and answer locally. By default they make no network calls to Buoy.
  • Telemetry, opt-in: the CLI asks once, in an interactive terminal. If you say yes, it sends an event name, whole-number counts (such as drift totals and file counts), the CLI version, your OS platform and a random anonymous ID. No file paths, repository names, tokens or account details. It never sends in CI or when BUOY_TELEMETRY=0 or DO_NOT_TRACK=1 is set. buoy ahoy telemetry shows the payload and turns it on or off.
  • Signing in: if you run buoy ahoy login and sync, the CLI uploads scan results (findings with file paths, lines and flagged values) to your Buoy account.
  • GitHub Action: runs in your CI with your token and posts to your pull requests. If you give it your own LLM API key, those calls go straight from your CI to that provider under your account. Buoy does not receive them.

GitHub App

What it reads, through GitHub

  • Pull request details, the changed files and their diffs
  • Files it needs for a review, such as .buoy.yaml, token and theme files, and DESIGN.md
  • For a first or baseline scan, a full clone of the repository
  • Recent commit history and blame for files with findings
  • Pull request comments that mention @ahoybuoy or reply to Buoy

Where it is processed

On Cloudflare Workers, Queues and Containers. Full clones go into a temporary directory inside a Cloudflare Container and are deleted when the scan ends.

What we store

  • Account: name, email address, GitHub login and avatar. GitHub access tokens are encrypted before we store them.
  • Installations and repositories: which organizations and repos use Buoy, and pull request numbers
  • Findings: type, file path, line, the flagged value (such as #3b82f6), the message, the suggested token, and the commit author when git provides one
  • Suggested fixes: for each fix Buoy posts, the original line and the suggested replacement, so we can tell whether it was adopted
  • Your design system: token names, values and source files, component names and paths, and your DESIGN.md if you use the dashboard editor
  • Conversations: @ahoybuoy threads, and replies where your team explains or declines a suggestion
  • Usage: review counts and health scores, product events, feedback you send, and the IP address and browser of requests to our API and dashboard

We do not store your source files or full diffs in our database.

Where an LLM is used

Findings come from deterministic rules. A model never decides whether something is a finding. An LLM only writes prose, in these places. Requests go through OpenRouter, which routes each one to a provider that hosts the model.

Builder-mode coaching on pull requests

Repos in builder mode (design maturity below 50, or not scored yet), when a review has more than two findings or a repeated pattern worth coaching

Sent: Up to 10,000 characters of the pull request diff, the findings, your token and component names, and the first line of recent commit messages for files with findings. The model can also ask for full file contents (up to 50,000 characters per file), code search results, commit history and blame, including author names and dates.

Model: Devstral 2, falling back to GPT-4o-mini

@ahoybuoy answers

When someone mentions @ahoybuoy on a pull request

Sent: The question, earlier comments in that pull request conversation, your token and component names, and any repository files, search results, commit history or blame the model asks for.

Model: Devstral 2, falling back to GPT-4o-mini

Review summary with custom instructions

Repos whose .buoy.yaml sets instructions

Sent: Your instructions, the number of findings and the names of the files they are in. No code.

Model: Devstral 2, falling back to GPT-4o-mini

Ask Buoy and report titles in the dashboard

When a signed-in user asks a question in the dashboard

Sent: The question and the dashboard data for that repo: scan statistics, findings with file paths and flagged values, token names and values, and pull request history.

Model: Qwen3.5-Flash

As of October 13, 2026, OpenRouter serves Devstral 2 from Mistral AI, GPT-4o-mini from OpenAI or Microsoft Azure, and Qwen3.5-Flash from Alibaba Cloud. How long OpenRouter and those providers keep requests is set by their own policies.

There is no per-repo switch to turn LLM prose off yet. If you need deterministic findings with no LLM at all, the open source GitHub Action gives you the same findings in your own CI.

Website

  • Page views: Cloudflare Web Analytics counts visits, referrers and browsers without cookies.
  • Events: a few actions, such as form sign-ups, are recorded in Cloudflare Analytics Engine with an anonymous visitor ID cookie (buoy_vid, one year). Fields that look like emails or tokens are dropped.
  • Repository scanner: when you scan a public repository at /scan, we clone it on Cloudflare, publish the report, and use your IP address for rate limiting.
  • Forms: download and update sign-ups send your email address to Loops. The support form emails your name, address and message to us through Mailgun.
  • Your browser: your theme choice and a page-layout test variant are kept in local storage.

How we use your information

  • Run the reviews, dashboard and website
  • Remember what your team declined or explained, so Buoy does not repeat itself
  • Send product email to GitHub App users, with an unsubscribe link in every message
  • Respond to support requests
  • Find and fix bugs, and measure whether reviews are useful
  • Meet legal obligations

Subprocessors

These companies process data for us. We will update this list when it changes.

Cloudflare

Hosting and processing for the website, API, GitHub App and dashboard: Workers, Pages, Containers, Queues, Durable Objects, D1, KV, Analytics Engine, Workers Logs and Web Analytics

Data: Everything the GitHub App and website process, including temporary repository clones during scans. Workers Logs are kept for 7 days.

GitHub

GitHub App installation, repository access, GitHub Marketplace and GitHub sign-in

Data: Pull request and repository data read through the GitHub API, and the reviews, comments and checks Buoy posts

OpenRouter

Routes LLM requests to the provider hosting each model

Data: The prompts described in "Where an LLM is used"

Mistral AI

Hosts Devstral 2 (mistralai/devstral-2512), the main model for review prose

Data: Pull request prompts, when OpenRouter routes them to Mistral

OpenAI and Microsoft Azure

Host GPT-4o-mini (openai/gpt-4o-mini), used when Devstral 2 fails

Data: Pull request prompts, when the fallback is used

Alibaba Cloud

Hosts Qwen3.5-Flash (qwen/qwen3.5-flash-02-23) for Ask Buoy and report titles

Data: Dashboard questions and the repo data sent with them

Clerk

Dashboard sign-in

Data: Name, email address and GitHub identity of dashboard users

Resend

Product email to GitHub App users

Data: Name, email address, the email itself, and delivery, open and click events

Stripe

Payments, only if you buy a paid plan

Data: Billing contact and payment details. Stripe holds card data; we do not.

Loops

Website download and update emails

Data: Email address and the download or list you signed up for

Mailgun

Delivers support form messages to us

Data: Name, email address and message

Sharing

We do not sell your personal information. Beyond the subprocessors above, we share data only:

  • When the law requires it, or to protect our rights or someone's safety
  • As part of a merger or acquisition, under this policy

Security

Data is encrypted in transit with TLS, and Cloudflare encrypts the data we store at rest. We also encrypt GitHub access tokens ourselves. Access to production data is limited to the people who run Buoy. No system is perfectly secure, so please email privacy@buoy.design if you find a problem.

Retention

  • Temporary repository clones are deleted when each scan ends.
  • Cloudflare Workers Logs are kept for 7 days.
  • Uninstalling the GitHub App removes the installation and the repositories and scan history tied to it. Your account and some review records, such as suggestion history and remembered declines, stay until you ask us to delete them.
  • Everything else is kept while you use Buoy. Email privacy@buoy.design and we will delete your data.

Your rights

Depending on where you live, you may have the right to:

  • Access the personal data we hold about you
  • Correct inaccurate data
  • Delete your data
  • Export your data in a portable format
  • Opt out of marketing email

Children's privacy

Our services are not intended for children under 13. We do not knowingly collect personal information from children under 13.

Changes to this policy

When this policy changes, we will post the new version here and update the date at the top.

Contact us