Privacy Policy

Last updated 30 July 2026

Who we are

Patchwork ("Patchwork", "we", "us") operates the Patchwork GitHub App and the website at patchwork.co.in. Patchwork detects breaking changes in your dependencies, rewrites the affected call sites, and opens a pull request. Reach us at pandey.abhisaar222@gmail.com.

What Patchwork accesses

When you install the GitHub App, you grant it an installation token scoped to the repositories you select. Patchwork requests three permissions and no others:

• Contents (read and write) — to clone the repository, read your manifest and source files, and push a patchwork/* branch.
• Pull requests (read and write) — to check whether a Patchwork PR is already open and to open a new one.
• Metadata (read) — to list which repositories the installation covers.

Patchwork does not request access to your Actions secrets, environment secrets, organisation members, issues, or any other resource. It cannot read repositories you did not include in the installation.

What leaves our infrastructure

Patchwork uses a large language model for two steps of its pipeline. This is the only point at which any part of your code is transmitted to a third party.

• Migration guide text — public changelog or release-notes text for the dependency being upgraded. Contains none of your code.
• Code regions around affected call sites — after an abstract-syntax-tree pass identifies the exact lines that use a changed symbol, Patchwork sends those regions, plus the file path, to be rewritten. It does not send your whole repository, unrelated files, or files that contain no confirmed usage.
• Package names — queried against the public npm and PyPI registries to learn the latest published version. No code is included.

What we store

Your source code is never stored. Patchwork clones each repository into an ephemeral temporary directory, runs the pipeline, and deletes that directory when the run finishes — including when the run fails. There is no database of your code, no cache of your files, and no backup.

What we do keep are operational logs, which record:

• the repository name and the installation it belongs to;
• which package was detected as behind, and which versions;
• whether each pipeline stage succeeded, and the resulting pull request URL.

These logs contain no source code. They are retained by our hosting provider under its standard log-retention window and are used only to operate and debug the service.

Sub-processors

We rely on the following third parties. There are no others.

• OpenAI — the model calls that extract breaking changes and rewrite code regions, via the OpenAI API. Under OpenAI's API data-usage policy, data submitted through the API is not used to train their models, and is retained for a limited period for abuse monitoring before deletion. See OpenAI's privacy commitments.
• GitHub — the source of the repositories and the destination for pull requests.
• Render — hosts the worker container that runs the pipeline.
• Vercel — hosts this website.
• npm registry and PyPI — public version lookups.

Where processing happens

Patchwork's worker and this website run on infrastructure located in the United States, and the model calls are processed in the United States. If you install Patchwork from outside the United States, your repository contents are transferred there for the duration of a pipeline run and then deleted.

Legal basis and your choices

We process this data to perform the service you asked for by installing the App. You control the scope directly:

• Limit what we can see — install Patchwork on selected repositories rather than all of them, and change that selection at any time in your GitHub installation settings.
• Revoke access instantly — uninstalling the App invalidates our token immediately. We retain no copy of your code, so there is nothing left to delete.
• Ask us to erase logs — email pandey.abhisaar222@gmail.com and we will delete the operational log entries associated with your installation.

If you are in the EEA or UK, you have rights of access, rectification, erasure, restriction, and objection under the GDPR. Because we hold no source code and only minimal identifiers, most requests resolve to the log deletion described above.

Website analytics

This site sets no advertising or tracking cookies and runs no third-party analytics scripts. Our host records standard server request logs.

Security

All traffic is TLS-encrypted. Webhook deliveries from GitHub are authenticated with an HMAC-SHA256 signature and rejected if the signature does not verify. We authenticate to GitHub as an App installation using short-lived tokens rather than a long-lived personal access token. Dependency installation during verification runs with lifecycle scripts disabled, under memory and wall-clock limits.

Children

Patchwork is a developer tool and is not directed at anyone under 16. We do not knowingly collect data from children.

Changes

If we change what leaves our infrastructure or add a sub-processor, we will update this page and change the date above. Material changes affecting existing installations will be announced before they take effect.

Questions about anything on this page? Email pandey.abhisaar222@gmail.com. See also our Terms of Service.