[ privacy ]
Written plainly, because you are trusting us with source code.
[ reviewing locally ]
Running tony --local touches this site not at all. The diff
and the files being reviewed go to Anthropic, which writes the
explanation. The page is written to .tony/ on your machine.
No account, nothing stored here.
[ publishing ]
Publishing is the default. A published review carries the diff and windows of the source around every line it explains. That is real source code, and it is stored here.
We also store your GitHub username, user id, and avatar URL; the repo name, branch range, and one-line summary of each review; and a session when you sign in. We never receive your GitHub password, and the GitHub token from signing in is used once to ask who you are and then discarded.
[ how it is protected ]
Reviews are encrypted before storage with AES-256-GCM and kept in a private store that is not reachable by URL. Sign-in tokens are stored only as hashes, so a copy of the database yields nothing that can be replayed.
What that does not protect against: tony holds the key. Anyone who can run code on this server, and any lawful demand made to us, can reach a review. This is protection against a leak, not against us. Do not publish from a repository you could not share with us.
[ who can read a review ]
Anyone signed in who has the link. Review ids are random and unguessable, so a link is what grants access. Treat it like a password.
[ deleting ]
Delete any review from your reviews, or run
tony unpublish <id>. Deleting removes the stored
review and its metadata, and the link stops working immediately. To
delete your account and everything in it, email us.
Reviews are kept until you delete them. We do not sell anything, and there is no advertising or third-party analytics on this site.