# Privacy Policy > CommitBrief has no telemetry, and this website runs no analytics and sets no cookies. Your diff goes only to the provider you choose. Last updated October 8, 2026 Canonical URL: https://commitbrief.com/privacy-policy/ --- This policy covers two things: the CommitBrief command-line tool and this website, `commitbrief.com`. ## What data is collected **The CLI collects nothing.** It has no telemetry endpoint, no analytics beacon, no crash reporter and no automatic update check. It never sends anything to the CommitBrief project. **This website collects nothing itself.** It serves static pages from a CDN, sets no cookies and runs no analytics or tracking scripts. Serving a page does mean our hosting provider, Cloudflare, processes your request metadata (see below). The fonts are served from this site, not from a third-party font service. The only data your browser keeps for this site is two small browser-storage entries, described in the [Cookie Policy](/cookie-policy/). ## Why data leaves your machine The CLI makes network calls only to do the job you asked it to do: - **Review your code.** A review, a commit-message suggestion or a compress run sends the diff you selected, together with your `COMMITBRIEF.md` rules and the prompt, to the provider you configured. Nothing is sent until you run a command, and the diff goes nowhere except that provider. Results are cached locally, never uploaded. - **Review a pull request.** `commitbrief remote pr` uses your own `gh` sign-in to fetch the PR diff from GitHub and, unless you pass `--no-post`, to post the review comments back to it. - **Set up a local model.** `commitbrief setup` asks your Ollama server (by default `http://localhost:11434`, or the `base_url` you configured) for its list of installed models. - **Update itself.** `commitbrief upgrade` is the only network call CommitBrief makes on its own behalf, and it runs only when you invoke it. It asks GitHub for the latest release tag, sending nothing about you. On a manual install it then downloads the release archive and its checksums from GitHub; on a Homebrew, Scoop or `go install` install it hands the upgrade to that package manager, which makes its own network requests. There is no automatic update check. ## Third parties and processors ### LLM providers (CLI only, by your choice) The website never talks to an LLM provider. The CLI does so only through the provider you selected, and each provider applies its own privacy policy and data-retention rules. Review them before sending sensitive code. - **Hosted APIs: `anthropic`, `openai`, `gemini`, `deepseek`, `mistral`, `cohere`.** One HTTPS call per review to the provider's API endpoint, carrying the diff and your rules file. - **`ollama`.** No outbound call by default. The CLI talks only to `http://localhost:11434`, or to whatever `base_url` you configured. - **CLI-backed: `claude-cli`, `gemini-cli`, `codex-cli`.** CommitBrief makes no network call itself. It launches the host CLI (`claude`, `gemini` or `codex`) as a subprocess and pipes the prompt to it. The host CLI then calls the provider it is signed in to, and that provider's policy applies. Provider privacy policies: - [Anthropic](https://www.anthropic.com/legal/privacy) (also used by `claude-cli`) - [OpenAI](https://openai.com/policies/privacy-policy/) (also used by `codex-cli`) - [Google](https://policies.google.com/privacy) (Gemini, also used by `gemini-cli`) - [DeepSeek](https://cdn.deepseek.com/policies/en-US/deepseek-privacy-policy.html) - [Mistral AI](https://legal.mistral.ai/terms/privacy-policy) - [Cohere](https://cohere.com/privacy) `ollama` has no entry: it runs locally, and any remote `base_url` you point it at is governed by whoever operates that server. ### Cloudflare Pages (website hosting) This website is hosted on Cloudflare Pages, which serves it on our behalf. Like any CDN, Cloudflare receives request metadata such as your IP address, user agent and the path you requested, and may log it to operate the service and prevent abuse. Its handling of that data is described in [Cloudflare's privacy policy](https://www.cloudflare.com/privacypolicy/). We do not access, export or correlate them. ### GitHub (star count) The GitHub star count in the site header is refreshed by your browser with a direct request to `api.github.com`. That request reveals your IP address and user agent to GitHub, under [GitHub's privacy statement](https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement). The result is cached in your browser for five minutes, so repeat visits within that window do not repeat the request; if your browser blocks site storage, the request is made on every page load. Links to GitHub (issues, discussions, source) are ordinary links; GitHub only sees you if you follow them. ## Retention We keep no visitor records, analytics or accounts. If you email us, we keep your message and address only as long as needed to handle it. CDN request logs are retained by Cloudflare, our hosting provider, for the periods its service sets; we do not keep copies. What an LLM provider keeps from a review is set by that provider's policy and your account settings with it. ## Your rights Apart from emails you send us, we do not store personal data about you, so there is normally nothing for us to access, correct or erase. If you believe we hold data about you, or you want to exercise a data-protection right, email and we will answer. For data held by Cloudflare, GitHub or an LLM provider, contact that company directly. ## Contact Privacy questions: . Bugs and general questions: see the [Contact](/contact/) page.