// PRIVACY

What happens to your code.

KIO is an independent project. This page describes exactly what it stores and where your code goes - no more, no less.

What KIO stores

  • Your account: the email address and display name from your sign-in, handled by Clerk. You can sign in with email or Google.
  • Your GitHub connection: an access token, encrypted at rest before it is saved. It is never written to logs, never sent to an AI model and never sent to your browser.
  • What KIO produces for you: repository analyses (file structure, symbols, import graph), review findings, proposed fix diffs, verification results, generated docs and reports.
  • An audit log of actions such as connecting GitHub, approving a fix or posting a review.

What is sent to AI models

  • To review a pull request, KIO sends the changed code and the related files its repository graph selects (tests, imports, callers), capped at roughly 12K tokens per call.
  • Those calls go to third-party model providers: OpenRouter, Groq and Google Gemini, tried in that order when one is unavailable. Their own terms govern how they handle requests.
  • GitHub tokens, your email and other account data are never part of a prompt.

What KIO does with your repositories

  • Connecting GitHub asks for the repo, read:user and read:org scopes, because reviewing a private repository requires reading it.
  • KIO writes to GitHub only after you approve that specific action: posting a review comment, or pushing a fix to a new kio/fix-* branch and opening a pull request from it. It never writes to your default branch, never force-pushes and never merges.
  • Fix verification runs your repository's own test command in a temporary workspace that is deleted afterwards. AI-generated code is never executed on KIO's servers outside that sandbox.

Where it runs

  • Vercel (website), Render (API), Neon (database), Upstash (job locking) and Clerk (sign-in), each on its free tier.
  • KIO uses no analytics, advertising or tracking scripts. The only cookies are Clerk's sign-in session cookies.

Removing your data

  • Disconnecting GitHub in Settings → Integrations deletes the stored token immediately. You can also revoke KIO at any time from GitHub under Settings → Applications.
  • To have your account and everything KIO produced for it deleted, open an issue or contact the author through GitHub.

Questions: github.com/vaibhav410