This policy explains what PatchForge Inc. ("PatchForge", "we") collects when you use the PatchForge web application
(the "Service"), why, who we share it with, and the choices you have. It forms part of our
Terms and Conditions.
1. Information we collect
- Account information: your email address, a hashed password, whether your email is verified, and your notification preference.
-
Git provider connections: when you connect GitHub, GitLab or Bitbucket, we receive an access token (and, where the provider issues one, a refresh token)
plus your account identifier and public profile details. Tokens are stored encrypted and are used only to read repositories on your behalf.
- Repository information: names, descriptions, languages, visibility, URLs and branch names of repositories your connected account can access, cached to show your project list.
-
Commit data: for the commits you select, their identifiers, messages, authors and dates. Changed file names, and the code changes themselves (diffs) if you enable
"Include code diffs", are read from your provider during generation. Diffs are used in memory to produce your notes and are not stored by PatchForge.
- Generated content: the patch notes, titles and descriptions we generate or you edit, and share links you create.
- Usage records: how many generations you start and how many AI tokens they use, to apply plan limits.
- Billing information: subscriptions are sold by Paddle, our merchant of record. Paddle collects your payment details; we receive your subscription status, plan and transaction records, never your full card number.
- Technical information: IP address, browser details and request logs needed to operate and secure the Service, and session cookies that keep you signed in.
2. How we use it
- To provide the Service: list your repositories, fetch the commits you select and generate patch notes.
- To enforce plan limits and bill subscriptions.
- To send service emails: email verification, password resets and, unless you turn them off in your profile, notices when your patch notes are ready.
- To keep the Service secure and reliable, including diagnosing errors.
We do not sell your personal information and do not use your code or commit data to train AI models.
3. Who we share it with
-
AI providers: commit messages, file names and (only if enabled) diffs for the commits you select are sent to the AI provider PatchForge uses to generate patch notes:
OpenAI, Anthropic or Google. We choose the provider and may change it. Each note is sent to the provider in use when it is generated (including regenerations); the patch note form names the current one. The provider processes this data to return the generated text under its API terms.
- Git providers: GitHub, GitLab or Bitbucket, which we call with your token to read repositories.
- Paddle: payment processing, invoicing and taxes.
- Infrastructure providers: our hosting provider, Cloudflare (network security and delivery), our email delivery provider, and an error-monitoring service that receives technical details of application errors.
- People you share with: anyone who has a share link you created can read that patch note until you disable the link.
- Legal reasons: when required by law or to protect the rights and safety of our users and the Service.
Some of these providers process data outside Canada, including in the United States.
4. Retention
- Account data, connections and patch notes are kept until you delete them or your account.
- Failed generations are deleted automatically after 30 days.
- Application logs are kept for about two weeks.
- Paddle and we may keep transaction records as long as tax and accounting law requires.
5. Your choices and rights
- Code sharing: turn off "Include code diffs" to generate notes from commit messages and file names only.
- Disconnect: deleting a connection deletes its stored token, cached repositories and the patch notes created from them. GitHub and GitLab tokens are also revoked; for Bitbucket, you can revoke access in your Bitbucket settings.
- Export: download any patch note as Markdown or HTML.
- Delete your account: from your profile. This cancels any subscription and deletes your connections, patch notes and usage records.
- You may also ask us to access or correct your information by emailing [email protected].
6. Security
We use encryption in transit, encrypt provider tokens at rest, and limit access to production systems. No system is perfectly secure;
if you believe your account has been compromised, contact us right away.
7. Children
The Service is not directed at children under 16, and we do not knowingly collect their information.
8. Changes to this policy
We will post any changes here and update the date above. For significant changes, we will notify account holders by email.
9. Contact
PatchForge Inc., 136 Market Ave #800, Winnipeg, MB R3B 0P4, Canada
Email: [email protected]