Privacy policy
The GitHub App is not open for installs yet. Until it opens, the only data we receive is email you send to [email protected]. This policy also describes what the App will process once it opens.
Who is responsible
Silvan Jost, Schmiedstrasse 28, 3284 Fräschels, Switzerland (“we”). Contact for privacy questions: [email protected].
What we process
Queue to Main is a GitHub App. It only sees the repositories you choose when you install it. We process:
- Installation data: the GitHub installation id, the account or organization id, login and type, install date, trial end date, and whether the installation is suspended or deleted.
- Queue data: repository names, pull request numbers, base branch names, test branch names (
fmq/…), commit SHAs, queue position and status, and timestamps. - Check results: names and states of the checks and commit statuses on queued pull requests and their test branches.
- Pull request titles: stored while the pull request is in the queue, to show on the queue page; deleted within minutes after it leaves the queue.
- Webhook delivery log: delivery id, event type, action, installation id, repository name and timestamps, for de-duplication and debugging, plus the ids of Stripe billing events and GitHub Marketplace purchase events we received (to process each once). Kept 14 days.
- Billing: if you subscribe, Stripe processes your billing email and payment details. We receive and store the Stripe customer and subscription ids and the subscription status. We never see full card numbers. If you buy through GitHub Marketplace instead, GitHub bills you and sends us the plan, price, billing cycle, unit count, free-trial and next-billing dates and cancellation dates for your account, which we store to know whether your plan is active; we do not store the billing email GitHub includes.
- Email: if you write to [email protected], your message and address.
No source code is stored. The App reads branch references, commit SHAs and check states. It creates test branches through GitHub’s merges API, so the merge happens on GitHub; we never download file contents. The pages of this website set no cookies and use no analytics or tracking.
Why (purpose and legal basis)
To run the merge queue you installed and to bill for it (performance of a contract), and to keep the service secure and debuggable (legitimate interest). We do not sell data or use it for advertising.
Who processes it for us
- Cloudflare, Inc. (USA): hosting of the App (Workers) and database (D1), this website (Pages), and email receiving (Email Routing).
- GitHub, Inc. (USA): the platform the App works on, and the seller if you buy through GitHub Marketplace; your use of GitHub is governed by GitHub’s own terms and privacy statement.
- Stripe: payments and the customer portal.
- Resend (USA): sending the automatic acknowledgement and replies to emails you send us.
- Anthropic (USA): emails to [email protected] are sorted with the help of Anthropic’s Claude; replies written with AI help say so.
Some of these providers are in the USA. Transfers rely on the providers’ standard contractual clauses or equivalent safeguards.
How long we keep it
- Queue entries: removed when the pull request is merged or leaves the queue.
- Webhook delivery log, Stripe and GitHub Marketplace event ids: 14 days.
- GitHub Marketplace plan record: while the plan runs, deleted within 7 days after it ends. If you cancel a Marketplace free trial, the plan record and the queue data, pull request titles and logs of that account’s installations are deleted within 7 days (unless the installation has a Stripe subscription).
- Pull request titles: while the pull request is queued.
- Installation data: while the App is installed, and deleted within 30 days after you uninstall it (queue data at once, the installation record within 7 days). Billing records (invoices, payments) are kept by Stripe or, for Marketplace purchases, GitHub, not by us, for as long as the law requires.
- Emails: as long as needed to answer, then deleted within 12 months.
Your rights
You can ask for access to, correction, export or deletion of your data, and object to processing, by writing to [email protected]. You can also complain to a data protection authority (in Switzerland the FDPIC; in the EU, the authority where you live).
Changes
We will post changes on this page with a new date. Material changes are announced to subscribers by email before they apply.