Privacy & account data

Browse freely. Sign in only when you want to save your work.

Public browsing

Public issue and project pages use licensed catalogues and a checked snapshot of GitHub metadata. Filters run in your browser and appear in shareable URLs. No advertising, fingerprinting or visitor analytics is enabled. Hosting providers process normal request information, including IP addresses and URLs.

When you sign in

GitHub and Supabase Auth process your sign-in. Supabase Auth may retain the identity and email fields GitHub supplies for authentication. FirstPatch uses your stable GitHub identity to associate your saved work and verify PR authorship. We do not use email addresses for marketing or import your private repositories.

Supabase PostgreSQL stores your saved issues, personal status, notes, theme, saved searches and linked PR metadata. These are private by default. GitHub PR status is checked through its API; we do not store PR bodies or review discussions.

Cookies and local storage

A temporary login cookie supports authentication. An encrypted HttpOnly session cookie keeps you signed in, with a maximum session lifetime of 14 days. A non-sensitive session indicator and an optional theme cookie help the interface work. FirstPatch does not use localStorage or sessionStorage. The theme cookie can last up to a year.

Services involved

Cloudflare serves the website and account API. Supabase processes authentication and stores account data in the Singapore project region. GitHub supplies login and public PR metadata. External links have their own policies. Scheduled checks use GitHub Actions and an authenticated API; private notes and credentials must not appear in public logs or artifacts.

Retention and control

Saved work stays until you remove it or delete your FirstPatch account. Background checks focus on open tracked PRs for recently active accounts. Sessions expire, and cached metadata can remain stale when an upstream service is unavailable. Supabase Free projects can pause after low activity.

In Settings, export your data, sign out or permanently delete your account. Deletion removes the application records and authentication identity and prevents further personal sync. Shared public PR facts may remain while another account tracks them. Provider operational logs and backups may retain information under their own policies; FirstPatch does not promise immediate erasure from every provider backup.

Revoke GitHub authorization separately in GitHub application settings. Deleting FirstPatch data does not delete your GitHub contributions.

Source rights and questions

Public catalogue attribution and reuse notices remain separate from private account data. Read the data sources and licence boundaries. For general questions or corrections, use the project tracker. Do not publish credentials, private notes or personal information in a public issue.