Privacy & data
Guided Review is designed so the extension does not phone home. Your PR content goes to your AI provider and (optionally) GitHub — not to a Guided Review backend. Short version also lives in the FAQ.
What the extension sends
| Destination | When | What |
|---|---|---|
| Your AI provider | Starting / streaming a review | Prompt built from the PR diff + schema instructions; API key in the Authorization header — Configure AI provider, How a review plan works |
| GitHub | Diff fetch, device OAuth, submit review | Diff/patch URLs, OAuth device flow, review API payloads you initiate |
| Guided Review servers | — | None for extension product paths |
The background service worker is the only context that holds the API key and performs cross-origin LLM requests. Line-comment drafts are not sent until you explicitly submit.
What stays local
- Provider choice, model, and API key (
chrome.storage.local) — Configure AI provider - Active review session: diff, plan, step index (
chrome.storage.session, keyed byowner/repo#number) — Resume later - Draft comments in the overlay until you submit
- GitHub tokens after Connect GitHub, until you disconnect
Closing the browser session clears session storage; local settings remain until you change or clear them. Session edge cases: Troubleshooting.
Website analytics
The marketing site may include anonymous analytics. That is separate from the extension. The extension does not embed that script and does not track review activity.
Full policy
Legal detail lives in the Privacy Policy, Terms, and Cookies pages. If something here conflicts with those documents, the legal pages win.
Questions? Email support@guidedreview.com. Product questions: FAQ. Setup problems: Troubleshooting.