Privacy policy.
Effective 10 November 2026. This policy covers the propr.dev website, ProPR Connect, and ProPR Hosted, operated by Unchained Development OÜ (Estonian registry code 16785055, Tallinn, Estonia). Self-hosted ProPR runs agents and execution on your infrastructure; ProPR Hosted runs them on a dedicated VM we operate. Connect processes webhook payloads and, with opt-in Plus storage, selected preview originals. Data also reaches the external services you use, as described below.
Overview
This website
propr.dev is a static site served through Cloudflare. It requires no account. Fonts and other site assets are served from our own domain. Cloudflare keeps standard server access logs (IP address, requested URL, user agent) for operational and security purposes.
Website analytics
Google Analytics runs after you select “Allow analytics.” It measures page views, site interactions, traffic sources, approximate location, and browser and device details. Google Analytics uses first-party _ga cookies to distinguish visitors and sessions. We use its aggregate reports to understand how people find propr.dev, which content they use, and which routes lead to product documentation, source code, and contact.
Consent is the legal basis for this processing. Selecting “Decline analytics” keeps the Google tag from loading. The “Analytics preferences” control in the footer lets you change your choice. Withdrawing consent removes Google Analytics cookies set through propr.dev and reloads the site without the Google tag. The site saves your choice in browser storage so it can apply that decision on later visits.
Google handles analytics data under its privacy policy and data processing terms. Google may process this data outside the European Economic Area under the transfer safeguards described in those terms.
Contact form and email
When you contact us through the contact form or by email, we receive the details you provide — typically your name, email address, and message. The form is delivered through Formspree, which processes the submission on our behalf under its own privacy policy. We use your details only to reply and to follow up on your request. We do not sell or share this information, and you can ask us to delete it at any time. If you subscribe to release notes, we store your email address to send them, and every message carries an unsubscribe link.
Self-hosted ProPR
The ProPR software (Apache 2.0) runs on infrastructure you control. Repository clones, task history, logs, and credentials are stored in your deployment. Prompts and selected context reach the providers you configure; requested MCP results also reach your chat host and, with the optional hosted gateway, Connect. Connect also receives selected preview artifacts when you enable Plus managed storage. The software does not report usage data to us. Calls to AI providers and GitHub are made with your own credentials, under those providers' terms.
ProPR Connect
ProPR Connect is a hosted service that relays GitHub webhook events to your self-hosted stack. It processes the GitHub account and installation details needed to route deliveries and manage seats. Connect processes full webhook payloads, including any source code included in GitHub issue or review comments. Webhook payloads are cleared after successful delivery. Failed deliveries are cached for replay for up to 24 hours on Connect Plus, or up to 1 hour (the newest 25) on the free tier. Delivery records and payload-free statistics are separate: statistics are kept as hourly totals by repository, target GitHub username, event, status, and timing, for 30 days on Connect Plus and 7 days on the free tier. Subscription payments are processed by Polar, which handles payment data under its own privacy policy; we do not receive your card details.
Plus managed visual previews
Community visual previews are GitHub-only: your instance uploads them as GitHub attachments with your own GitHub credential, deletes its temporary copies after publication, and Connect never receives them. When you opt in to Plus managed storage, your stack uploads selected full-resolution/original preview artifacts to private Cloudflare R2 while continuing to publish eligible inline review copies to GitHub. These images or videos may contain application UI, code, repository-derived information, or personal data visible in the captured application. Connect also stores metadata — the task ID, repository name, pull request number, a sanitized filename, media type, size, SHA-256 checksum, and timestamps — to associate each artifact with its installation, repository, and task, display it, and enforce storage limits and expiry.
We process these artifacts and metadata to provide storage and authenticated review, enforce quotas and retention, and operate and secure the service. Cloudflare processes hosted data on our behalf as our storage and infrastructure processor under its Data Processing Addendum, including its applicable international transfer safeguards.
Preview access and content
The authenticated ProPR Connect viewer serves originals to users authorized for the installation. Access is installation-wide: an authorized user may view originals from any repository in that installation, and repository permissions add no separate access boundary within the viewer. A viewer link alone does not grant access, and download links expire within minutes. GitHub’s own access rules and terms govern the inline copies.
You retain ownership of uploaded artifacts and grant the limited service licence described in the Terms. Upload only material you are authorized to share with the installation’s users. Do not upload credentials, secrets, unlawful or infringing material, malware, or personal data you have no right to share. Review captures for sensitive content before upload.
Preview retention and deletion
The defaults are 25 GiB per installation, 500 MiB per object, and 90-day retention. Originals expire 90 days after upload; storage cleanup then deletes them. Changing or cancelling your plan does not move that date. You may request earlier deletion of artifacts and associated metadata by contacting sales@propr.dev with the installation and artifact details. We verify your authority before acting on a deletion request.
Downgrading to Community or otherwise losing Plus blocks new managed uploads; originals already stored stay accessible to users still authorized for the installation until they expire under normal retention. Uninstalling the GitHub App removes installation access; Connect then immediately queues the installation’s preview artifacts for deletion, removes them in hourly batches, and retries any failed R2 cleanup. Uninstalling the local ProPR software alone does not delete hosted data. Managed storage is temporary review storage; download the originals you need before expiry or uninstall.
Deleting or expiring a managed original leaves copies already published to GitHub or downloaded by users in place; manage those copies separately. Account, billing, and operational records serve separate purposes from preview storage, and the 90-day artifact retention period does not apply to them.
Optional MCP access
Check MCP availability and operator setup requirements.
Direct MCP connects your chat host to your instance and bypasses Connect. The optional Connect MCP gateway processes tool arguments and results in transit to and from your instance through a managed tunnel. These payloads can contain prompts, source code, repository context, diffs, and artifacts. The gateway processes their contents; it provides no end-to-end encryption through Connect.
Browser OAuth identifies your account and binds app access to an installation, scopes, and repository restrictions, with connected-apps revocation. The gateway forwards MCP requests and results without an intentional application payload store or replay cache. Connect stores OAuth client and pending-consent data, instance registration, grant identity and repository/scope restrictions, token/session hashes, proof-replay records, and encrypted GitHub credentials separately. Revocation clears the grant’s encrypted credential; scheduled cleanup clears expired credentials and removes grant metadata and associated hashes 30 days after expiry or revocation. Registration records follow a separate lifecycle.
The gateway returns generated request IDs and fixed diagnostic errors; scheduled cleanup logs a fixed failure message. These source-level limits do not guarantee zero logging or retention by Cloudflare, operator infrastructure, the chat host, or its model service. Cleanup depends on the configured maintenance job. Webhook payload retention statements apply only to webhooks. Read the public core/Connect contract.
Your chat host and any model service it uses receive the content returned to the conversation under their own policies. ProPR's MCP interface is scoped to text and structured data. Any speech input or output is handled by the host. Enter credentials through browser authentication and setup, outside the conversation.
ProPR Hosted
ProPR Hosted adds an operator-managed ProPR backend. The dedicated VM processes and stores the repository clones, prompts, task history, logs, settings, GitHub installation access, tunnel and relay credentials, and AI provider credentials needed to run the tasks you request. Encrypted application backups contain the ProPR database, protected service configuration and encryption keys, stored agent credentials, ProPR settings, and queue state; they exclude repository clones, agent workspaces, and logs. Git branches, commits, pull requests, comments, and checks continue to be stored by GitHub, while prompts and selected repository context reach the AI provider you configure under that provider's terms. Hosted subscriptions are paid through Polar, as described for Connect.
We use Hosted data to provide, secure, monitor, back up, troubleshoot, suspend, restore, and decommission the service. Authorized operators may access infrastructure and service data when required for those purposes. Infrastructure changes are recorded through the fleet operation history, while ProPR records instance-role changes in its role audit history. Activation requires an agreed suspension, export, and deletion schedule. We retain a canceled or suspended instance and its backups for that schedule, then remove the instance through the guarded decommission process. Encrypted backups that remain after the instance is destroyed are kept for 60 days after destruction, separately from the plan's rolling backup retention. After that window, purging them needs two operator approvals. You may request an export or earlier deletion where contractual, security, and legal obligations allow it.
Your rights and contact
Unchained Development OÜ is based in Estonia, so EU data-protection law (GDPR) applies: you can request access to, correction of, or deletion of personal data we hold about you. Write to sales@propr.dev for any privacy request or question. If this policy changes, the effective date above changes with it.