Privacy

Who we are

ELI5 bot is run by Appstyx SRLS, Via San Morese 9, 50019 Sesto Fiorentino (FI), Italy, P.IVA 06456860489. For anything about your data, email hello@eli5bot.com.

The waitlist

When you join the waitlist we store your email address and when you joined. We use it only to email you about access, and we don't share it with anyone except the providers listed below that run our systems.

This site runs no analytics or tracking scripts, and its pages set no cookies until you sign in. Signing in sets two cookies on api.eli5bot.com that only keep you signed in: one for the few minutes signing in takes, and one for your session, for up to 8 hours. Fonts are served from this site, not from a third party.

The GitHub App

Once you install the app on your repositories, it:

• reads the pull requests it explains: their code, description, commits, and the issues and pull requests they mention, when the pull request's author can see them;
• does all of this in a virtual machine created for that run, which can connect only to GitHub and OpenRouter and is destroyed as soon as the explanation is written. Outside that machine, our service sees only the pull request's description and commit messages, to find what it links to, and the finished explanation;
• writes one comment on each pull request, its own explanation.

We keep the explanation, usage numbers for each run (tokens and cost), the pull request author's GitHub username, and the 👍/👎 reactions and replies the explanation gets, with the usernames of the people who left them. We also keep the GitHub account the app is installed on and its runs: how many it has, how many are used and when they expire. We don't keep your code.

Signing in and paying

You sign in to see your accounts with GitHub, which tells us your GitHub user ID and username, and which of the accounts with the app you own or manage billing for. We keep that for your session, and remember which accounts you managed, so an account the app was removed from still shows to you: your own account, and an organization for 90 days. We don't keep your GitHub token.

Plans and runs are sold by Link, Stripe's checkout, as the seller: it collects your payment details, name and billing address, and sends receipts and invoices. We keep the account's Stripe customer ID, its plan, the card's brand and last four digits, who started the plan and who changed it since, so everyone managing the account can see them. We never see your full card number.

Who processes it

• Railway hosts this website, the service, the virtual machines that read your code, and the database, including the waitlist, in the EU (Netherlands).
• Cloudflare delivers this website and the service to your browser and protects them from abuse, which means it handles your IP address. It tells the service which country you're in, so prices show in your currency.
• OpenRouter passes the code being explained to the AI model that writes the explanation. It doesn't store prompts or responses, only metadata such as token counts. Our requests only go to inference providers with a zero data retention policy, which keep no copy of what they're sent and so can't train on it.
• GitHub provides the code, receives the comment and signs you in.
• Stripe sells plans and runs through Link and tells us which plan an account is on and when it's paid.

How long we keep it

• Your waitlist address: at most 24 months after you signed up. Ask us and we delete it straight away.
• Explanations and run records, including the pull request author's username: while the pull request is open, then for 90 days after it's merged or closed, and never more than 24 months after they were written. If you uninstall the app or remove a repository from it, they're deleted within 30 days.
• Usage numbers for each run: as long as the run's explanation.
• Your account and its runs, including its Stripe customer ID, plan, card brand and last four digits, and who changed the plan: until 12 months after its last runs expire, once we keep none of its pull requests.
• Your session: 8 hours, or until you sign out. Which accounts you managed: as long as the account.
• Reactions and replies, with the usernames of the people who left them: as long as the explanation they belong to, and at most 12 months.
• Your code in the run's virtual machine: destroyed with the machine as soon as the run ends, and within 5 minutes if the run is interrupted.
• Service logs: Railway deletes them after 30 days at most.

When runs, reactions and replies are deleted, we keep monthly totals for each installation of the app: how many runs, what they cost, and how many reactions and replies they got. The totals contain no names.

Why we're allowed to use it

• The waitlist: to take a step you asked for before any contract, telling you when you can use the app (GDPR article 6(1)(b)).
• Explaining pull requests, signing in and paying: to provide the service to the account that installed the app (article 6(1)(b)).
• Usage numbers, reactions, replies and service logs: our legitimate interest in running the service securely and making the explanations better (article 6(1)(f)). You can object to this at any time.

Outside the EU

Our database is in the EU, but Railway and OpenRouter are US companies and most inference providers are outside the EU, so your data can also be processed in the United States. Railway and OpenRouter cover these transfers with the EU's Standard Contractual Clauses.

Your rights

You can ask to see the data we hold about you, correct it, delete it, limit how we use it, object to its use, or get a copy in a portable format. Email hello@eli5bot.com and we'll reply within a month. You can also complain to Italy's data protection authority, the Garante per la protezione dei dati personali, or to the authority where you live.

Last updated 31 October 2026.