Rubberduck Me
Privacy policy
Last updated: 1 September 2026
The short version. To explain a pull request, we fetch its diff from GitHub using your own authorisation and send it to an AI provider. We store that diff, and your questions, so tours can be reused. We do not collect your email address, we set no cookies, and we run no analytics.
Who this covers
This policy covers the Rubberduck Me Chrome extension, the service it
talks to at api.rubberduckme.com, and this website. In
it, “we” means the operator of Rubberduck Me, reachable at
hello@rubberduckme.com.
What we never collect
- No email address. Signing in with GitHub does not request one, and there is nowhere in our database to put one.
- No cookies and no analytics, in the extension or on this website. This site loads no third-party scripts, fonts or images, and no advertising.
- No browsing history. The extension only runs on GitHub pull request pages and cannot see your other tabs.
- We do not sell or rent personal data, and never have.
What the extension keeps in your browser
Four values, and nothing else:
- Your session token, with its expiry. It is deliberately kept in local storage rather than Chrome sync, so it does not travel to your other devices. It is deleted when you sign out or it expires.
- Three preferences that do sync: the server address, whether the voice is muted, and whether explorer mode is on. None of them are personal data.
What the extension sends us
When you use the duck on a pull request, it sends:
- the repository owner, repository name and pull request number;
- which tour and which stop you are on;
- the path of the file you are looking at;
- any question you type.
The extension does not upload the page or the diff. Our server fetches the diff from GitHub itself, using your authorisation.
One thing worth calling out. If you select code in the diff and ask about it, up to the first 300 characters of the text you selected are included in the question. That means the selected code is sent to our server, stored with the rest of the conversation, and forwarded to our AI provider along with it.
What our server stores, and for how long
| What | Details | Kept for |
|---|---|---|
| Your account | GitHub numeric id, username, display name, the organisation you signed in through, and your GitHub access and refresh tokens, encrypted with AES-256-GCM. No email address. | Indefinitely |
| Sessions | A one-way hash of your session token — never the token itself. | 30 days, extended while you keep using it |
| Tours | The generated walkthrough and the material it was built from: the full line-numbered diff, the pull request description, and the commit messages. | Indefinitely |
| Questions and answers | Your questions as written — including any code you selected — and the answers given. | Indefinitely |
| Reading progress and generated notes | Which stop you reached, plus per-file annotations and stop walkthroughs. | Indefinitely |
| Synthesized speech | MP3 audio of the narration, so replays are not re-billed. | 180 days, then deleted automatically |
| Server request logs | Request method, path and timing. | 1 month |
| Database backups | Automated snapshots. | 7 days |
Who can see what, inside your organisation
Planning a tour is expensive, so a tour is shared across your organisation: another person opening the same pull request at the same commit sees the same walkthrough, without it being generated again. Your questions and answers, and how far through you are, are not shared — those stay yours.
Nobody outside an organisation that has installed the app can reach any of it. Access is re-checked against GitHub on every request.
Deletion and export
We would rather be straight with you than describe a button that does not exist: there is currently no self-service way to delete or export your data. Tours, questions and account records are kept indefinitely unless you ask us to remove them.
If you want your data deleted or a copy of it, email hello@rubberduckme.com and we will do it by hand. If you are in the UK or EEA, you have the right to access, correct, delete, restrict or object to our processing of your personal data, and to complain to your local supervisory authority. Those rights apply regardless of whether the software has a button for them.
Who else your data reaches
| Provider | What they receive |
|---|---|
| Anthropic (Claude) | Pull request metadata, the description, commit messages, the full diff, the generated tour, the earlier questions in your thread, and your question. Prompt caching is enabled, so this content is held briefly on their side to make follow-up questions cheaper. No GitHub username, user id or organisation name is sent. |
| OpenAI or ElevenLabs | Whichever voice provider is configured receives only the narration script to read aloud. Those scripts routinely quote your code. |
| GitHub | Requests for the pull requests you open, made with your own authorisation, on your behalf. |
| Amazon Web Services | Hosting for the service, its database and the audio cache. |
Your content is processed by these providers under their own API terms, which govern what they may do with it. We do not use your code to train any model of our own.
Where your data is processed
The service, its database and the audio cache run in AWS's Stockholm
region (eu-north-1). This website is served from
Amazon CloudFront. The AI and voice providers process content in the
United States, so using Rubberduck Me involves an international
transfer of the content described above.
How it is protected
- Everything is served over HTTPS.
- GitHub tokens are encrypted with AES-256-GCM before being stored.
- Session tokens are stored only as one-way hashes, so a copy of the database does not let anyone sign in as you.
- The database is not reachable from the internet — it sits in an isolated network with no public address, and its storage is encrypted.
- The GitHub App is read-only. There is no shared server-side token that can see more than the person making the request.
This website
These pages are static files on a content delivery network. They set no cookies, run no JavaScript, load nothing from third parties, and we have not enabled request logging on them.
Changes
If this policy changes in a way that affects what we do with your data, we will update the date at the top and, for anything significant, tell affected organisations directly.
Contact
Questions, deletion requests, or anything else: hello@rubberduckme.com.