Privacy and data use

The short version

Rolt processes only the account, repository, review, and billing data needed to provide, secure, and improve the product, and the feedback you choose to send us. Rolt does not use private source, pull request content, or findings for global or cross-customer model training. We do not sell personal information.

Who we are

Rolt is operated by Rolt AI, Inc., a Delaware corporation. We decide how the account, billing, website, and support data described here is used. For an organization's repository content and review data, we act for the organization that connected the repository and use that data only as this page describes; an organization that needs a data processing agreement can request one from our privacy contact, and we refer an individual's request about that data to the organization. Account and repository data is needed to provide Rolt; analytics are optional. We make no decision with legal or similarly significant effects about you by automated means alone.

How we collect and use data

We receive data directly from you when you create an account, choose settings, contact support, send us feedback, or provide billing information. We receive authorized identity and repository data from WorkOS and GitHub, and payment status from Stripe. The product also creates operational records when it authenticates a request, runs a review, applies a setting, or recovers interrupted work.

We use this data to provide and secure the service, enforce workspace and repository access, perform requested reviews, answer support requests, administer billing, prevent duplicate charges, investigate failures and abuse, comply with legal obligations, and improve reliability using the measurements and review traces described below. We do not use payment details or private customer content for advertising.

If you are in the European Economic Area, the United Kingdom, or Switzerland, our legal bases are: performing our contract with you or your organization, to provide accounts, hosted reviews, and billing; our legitimate interests in securing Rolt, preventing abuse and duplicate charges, diagnosing and improving reviews, and counting visits to our public pages without cookies, which we weigh against your rights; our legal obligations, such as keeping billing records for tax; and your consent, for optional analytics, which you can withdraw at any time on the cookie notice.

Hosted reviews

For an authorized hosted review, Rolt receives the repository and pull-request identifiers, the selected head and comparison evidence, the bounded source context needed for that review, and the resulting findings and Story. We record review state, evidence references, model route, bounded operational metrics, and usage facts so the result can be explained, recovered, and billed exactly once. Model reasoning is never shown or kept in review history; the step records described below may hold the reasoning some models return until they are deleted.

Working copies. To review a pull request, Rolt builds its Story: the full source, before and after, of each file the pull request changes, and their diff. A Story is a working copy. Rolt keeps the Story of the pull request's latest commit while the pull request is open, and the Story of any review still running; Stories of earlier commits are deleted once no review needs them. All of a pull request's Stories are deleted 30 days after it is merged or closed, or after Rolt loses access to its repository. While a review runs, Rolt also records the steps of its analysis, including the source excerpts it read, so an interrupted review can resume; these records are deleted 30 days after they are written.

Review history. Each finished review is saved as review history: its findings and comments, its walkthrough, and what its review page shows. That is the diff of each changed file at the reviewed commit (for a new file, its whole content), the pull request comments the page shows, and only the lines of other source the page displays: the first line of each changed declaration, the code each walkthrough step shows, and a few lines above each comment. It is kept while your organization uses Rolt, so you can open any earlier review of a pull request, and deleted as described under Retention, export, and deletion.

The snapshot of the repository captured for a review is kept only while a review can still need it. It is deleted 24 hours after no open pull request in the repository is at the reviewed commit (its pull request was merged or closed, or a newer push replaced that commit), and never later than 30 days after capture.

To diagnose and improve reviews, each model request and response in a hosted review, and in the work a review leads to (reading replies to its comments, judging whether its findings were fixed, reading the repository's review guidelines), is recorded in Langfuse, our review-tracing provider, including the source and comment text it carries, and deleted there within 30 days. Model reasoning is removed before it is recorded.

Free reviews of public pull requests

When you ask for a free review of a public GitHub pull request on our website, Rolt reads the pull request and its public repository from GitHub and reviews it as it does a hosted review (above), without posting anything to GitHub. Anyone with the review's address can read the review and its Story. We delete them 30 days after the first request for that pull request. Rolt checks at least every hour whether each repository with a public review is still public. It stops showing a repository's reviews at the first check that does not find it public, and deletes them when the next check confirms it. A repository's maintainer can ask our privacy contact to remove its public reviews; we delete them and review it no more.

To limit free use, our web server turns your IP address into a one-way code that changes every day, and Rolt stores only that code, until the day after you ask ends (UTC), both to count the day's free reviews and alongside the review it asked for, so that the first review of the day declined for its size gives you your place back. When you ask, a bot check, Cloudflare Turnstile, runs in your browser, and Cloudflare processes your browser's signals, your IP address among them, under its own privacy policy. As with any review Rolt runs, the review's billing records keep the GitHub account ID of the pull request's author (see Billing data). Nothing from a public review is used to train models or to teach Rolt about the repository. A review page is counted without cookies like our public pages (below), by its route alone: its repository, owner and pull request are never sent to PostHog or Vercel.

Account and organization data

We receive identity and session data from our sign-in provider and store a display profile, organization membership and role, authorization records, connected GitHub installation and repository identifiers, organization settings, and the version of our Terms the admin who created the workspace agreed to, and when. Our service logs, which record each request's method, path, status and timing, are kept for 14 days. Membership follows your GitHub account, and an owner can manage repository access. Your profile and memberships are kept while your account exists, and the record of the Terms an admin accepted is kept as the record of that agreement. A sign-in session's record is deleted about a day after the session ends, or 366 days after you sign out, so a signed-out session cannot be reused.

Who belongs to a workspace. To decide who may open a workspace, Rolt reads from GitHub who belongs to the GitHub account it is installed on (its members, admins and outside collaborators, or a personal account's repository collaborators) and keeps each person's GitHub user ID and role there, including people who never sign in to Rolt. It keeps no name, login or email of them. A person's record is deleted once GitHub no longer lists them, or when Rolt is uninstalled from the account.

Your review progress. The files you mark viewed on a pull request, with the change you viewed so Rolt can tell you when it changes again, and the walkthrough steps you mark done are kept for you alone: no one else in the organization sees them. They are deleted 30 days after the pull request is merged or closed, or after Rolt loses access to its repository, and with the pull request's review history.

Feedback. When you report a bug or request a feature in the app, we receive what you write and whether it is a bug or a request, your name, email and Rolt account ID, the workspace you sent it from and its ID when you sent it from one, the address of the page, and the ID of the request that carried it. It is held by Sentry, where we read it, for as long as our Sentry plan keeps events (90 days today). It is sent only when you press Send, and it is not analytics, so it does not depend on your cookie choice.

Billing data

Rolt stores the customer and organization mapping, each month's reviewed pull requests, their credits and active authors (each author's GitHub account ID), the intro offer, the spend limit, invoice references, payment status, the kind of payment method on file and, to name it on the Billing page, a card's brand and last four digits or a bank account's last four digits, reconciliation evidence and, for an intro offer given before 12 October 2026 to an organization that had saved a card or bank account, a one-way hash of Stripe's fingerprint of it, which was used then to give the offer once per payment method and is no longer collected. Stripe stores card numbers, security codes, bank account and routing numbers, the payment authorization a bank debit needs, the account holder's name, the billing address used for tax, the name invoices bill (the organization's, or a business's legal name) and a business's tax ID when it gives one, and receives each month's invoice lines. When a bank account is connected through Stripe Financial Connections, Stripe receives the account details the bank shares to verify it, which Rolt neither receives nor stores. Rolt stores only provider identifiers and the details above needed to show and recover billing. Billing records are kept for 7 years after their billing month, then deleted.

Service providers

We use GitHub for repository access; WorkOS for sign-in; Amazon Web Services for application infrastructure and storage; Neon for managed PostgreSQL; Vercel to host our website and the app's web pages, and for a cookieless count of visits to our public pages (Vercel Web Analytics); Fireworks AI and Together AI as model APIs for hosted reviews, with zero data retention; TypeSafe for typed checks within a review, with zero data retention; Langfuse for review tracing (30 days); Sentry for error monitoring and for the feedback you send from the app; Stripe for invoices and payment collection; PostHog for optional, consented analytics and a cookieless count of visits to our public pages; Cloudflare Turnstile for the bot check on free public reviews; and Chatwoot for support, only when you open it. Each provider receives only the data needed for its role. We may also disclose data when legally required or to protect users and the service.

Rolt runs in the United States, on Amazon Web Services, and our providers process data in the United States and other countries where they operate. When personal data from the European Economic Area, the United Kingdom, or Switzerland goes to a country without an adequacy decision, we rely on the safeguards in our providers' data processing terms, such as the European Commission's standard contractual clauses; our privacy contact can send you a copy. Error reports in Sentry are kept while needed to diagnose errors, optional analytics in PostHog while needed to understand how Rolt is used, visit counts in Vercel Web Analytics for 12 months (our plan's reporting window), and support conversations in Chatwoot while needed to answer you, each under that provider's retention settings for our account; we delete them on request.

No training and zero data retention

No training and zero data retention are different promises. Rolt does not use private customer content as global training data.

The model providers that run a hosted review, Fireworks AI and Together AI, do not store or log its prompts or responses, under zero data retention on Rolt's account. A request is held in the provider's memory only while it is served (on Fireworks, a few minutes more in its prompt cache). Rolt calls only open models on Fireworks, which it neither logs nor stores, and prompt and response storage is off for Rolt's Together organization. Rolt refuses to send a review's request to any model provider without zero data retention. TypeSafe, which runs a review's typed checks, keeps no prompts or responses either, under zero data retention on Rolt's account.

Zero data retention covers these providers. Rolt's own records of a review (its repository snapshot, working copy, review history and Langfuse traces) are kept and deleted as this page describes.

Retention, export, and deletion

Working copies (Stories) and repository snapshots are short-lived, as described above. Review history and learned guidelines are kept while your organization uses Rolt, and deleted:

• within 7 days of an organization owner confirming a deletion request, for a pull request, a repository, or the whole organization;
• 30 days after a repository is disconnected from Rolt or Rolt loses access to it, for that repository's review history and the guidelines learned from it, unless access returns first;
• 30 days after the organization is deleted, for its review history, learned guidelines, and every other record of its repositories except the billing and review request records described below.

Deleted data may remain in our providers' recovery copies for up to 7 days, and review step records and model traces are deleted on their own 30-day schedule (above). Comments Rolt posted on GitHub are part of your pull request on GitHub and are removed there, not by Rolt. Billing records are kept for 7 years after their billing month (above), and the record of each review request and check (identifiers and counts, no source or comment text) is kept with the billing records, for 7 years after the month of the review.

An organization owner deletes the whole organization in Rolt, from its Settings: everyone loses access at once, Rolt's GitHub App is uninstalled from the organization's GitHub account, and its review history and learned guidelines are deleted as above. To have part of it deleted sooner, an organization owner emails our privacy contact naming the organization and what to delete: a pull request's review history, a repository's data, or learned guidelines. We confirm the request with an owner before deleting anything. You delete your own account from your Account page: each workspace you are the only member of is deleted with it, as above, and one you are the only owner of while others are members needs another owner first. Erasure empties your profile, deletes your linked GitHub account record, ends your sessions, ends your memberships, keeping only a record that the memberships ended, and deletes the feedback you sent from Sentry; the record of who belongs to an installed GitHub account keeps your GitHub user ID and role there for as long as GitHub lists you; comments you wrote stay in an organization's review history until that history is deleted, and a pull request you open later in a connected repository is reviewed as an outside contributor's. Billing records of each reviewed pull request keep its author's GitHub account ID, as the record of what was billed, and a keyed one-way code of it, by which billing counts each person once; the record of who started an organization's billing keeps that code of the starting owner's account, and so does the record of the first free intro credits given to that account, so the credits are given once per account. These stay after erasure and are deleted with those billing records.

Your rights

Depending on where you live, you can ask to access, correct, export, or delete your personal data, to restrict or object to how we use it, and to withdraw consent you gave. You can delete your account yourself (above); send other requests to our privacy contact. We answer within one month, may first confirm that the request is yours, and do not charge for reasonable requests. We do not sell personal information or share it for cross-context behavioral advertising. You can also complain to your local data protection authority.

Rolt accounts are not for anyone under 16, and we do not knowingly keep an account of someone younger; if you believe we have one, tell our privacy contact and we will delete it.

Learning

Team knowledge is governed, versioned context scoped to a repository or organization: the guidelines Rolt learns from your repository and from review comments and replies. Learned guidelines, and the review comments they were learned from, are kept while your organization uses Rolt and deleted by the rules above. Owners can inspect and remove them; a removed guideline stops applying at once, and its wording and the comments it was learned from are deleted with the review history by the rules above. To export them, an owner emails our privacy contact.

Cookies and optional analytics

Rolt uses an opaque, secure session cookie for authentication, and a cookie for your theme. Local browser storage remembers functional choices such as collapsed navigation, the places you opened recently in the command menu (pull request titles among them, cleared when you sign out), session-refresh coordination, and this privacy choice. These items operate the product; none is used for behavioral advertising.

Optional PostHog analytics stay off until you allow them. After consent, we may measure page visits, feature use, performance, and errors, and we may record a masked session replay to diagnose product problems. Story, file diffs, and the Memory page (learned guidelines) are excluded from recording. Product URLs are stored as route templates, not as organization slugs or pull-request identifiers. We do not send source code, prompts, findings, repository names, or email to PostHog. We do not use visitor-identification services. A Global Privacy Control signal keeps optional analytics off; browsers' Do Not Track signal has no common standard, so we rely on Global Privacy Control instead. Controls and durations are on the cookie notice.

Until you choose, and if you decline, our public pages (the home page, these legal pages, the sign-in pages and the pages of free public reviews) still count your visit without cookies. PostHog counts it by a hash it makes on its servers from your IP address and browser with a salt it changes every day, so a count does not follow you from one day to the next. Nothing is stored in your browser, nothing is recorded as a replay, and nothing inside the product is counted. We see the pages you view, how long you stay, what you click and the campaign parameters of the link that brought you. A Global Privacy Control or Do Not Track signal stops the count.

Whatever you choose, Vercel, which hosts our website, also counts visits to the same public pages with Vercel Web Analytics, without cookies or any other browser storage. Vercel tells visits apart by a hash of your request that it discards after 24 hours. It receives the page's address, templated as above (a public review by its route alone, and of a query only campaign parameters such as utm_source and ad click identifiers such as gclid), the website that linked you here (by its origin alone, such as github.com), the time, the location your IP address points to (country, region and city), and your browser, operating system and device type; never what you click, and nothing inside the product. A Global Privacy Control or Do Not Track signal stops this count too.

If you intentionally open the support tool, your conversation is held by our support provider, Chatwoot; the chat in the page ends when you leave or change account or workspace.

Security

Rolt uses tenant-scoped authorization, short-lived provider access, encryption in transit and at rest, secret isolation, signed webhook verification, and audited recovery paths. No online service can promise absolute security; please report a suspected incident promptly to our privacy contact.

Updates and contact

We may update this page as the product or legal requirements change and will publish a new effective date. We email organization owners at least 14 days before a material change takes effect, such as a new provider that receives source code, a new use of your data, or longer retention. Changes required by law or needed to address security or abuse may take effect when published. For a privacy request or a question about a specific review's data path, email our privacy contact at privacy@rolt.ai.