Privacy Policy

Flyovers reads your pull requests to generate video walkthroughs. This policy explains what we collect, who it is handed to, how long it survives, and how to have it removed.

What we collect

• Repository data: When you connect a repository, we read pull request diffs, commit messages, and related file contents solely to generate your flyovers.
• Account data: Your name, email address, and avatar provided by the identity provider you sign in with.
• Billing data: Payment and subscription records are managed by Polar, our merchant of record. Payment card details never touch our servers.

How we use data

• To generate and deliver diagrams, narration, and video walkthroughs for your pull requests.
• To manage your account, authenticate access, and respond to support inquiries.

What we do not do

• We do not sell personal data or source code.
• We do not use your code to train AI models.
• We do not access repositories you have not explicitly connected.

Who your data is handed to

Generating a flyover means sending your code to a model, turning a script into audio, and storing what comes out. Each of those is somebody else’s service. This list is derived from the code that makes the calls, so it changes when the software does.

OpenRouter (and the model provider it routes to)

Region not confirmed

Generating the walkthrough: reading the diff, planning chapters, writing narration.

Receives: Source code, diffs, commit messages and pull request text from the repositories you connect.

Routing is pinned to providers that do not retain prompts (`provider.data_collection: "deny"`). The specific model provider serving a request varies by availability.

Microsoft Edge text-to-speech

Region not confirmed

Turning the narration script into audio.

Receives: The narration text, which is written from your repository content.

Reached through the `edge_tts` client library rather than a commercial agreement. Treat it as the weakest link in this list.

Cloudflare R2

Region not confirmed

Storing rendered flyover videos and their assets.

Receives: The finished video, its diagrams and its narration audio.

Neon

United States, West (us-west-2)

The application database.

Receives: Account records, repository and pull request identifiers, flyover metadata.

Clerk

Region not confirmed

Authentication and session management.

Receives: Email address, name and avatar from the identity provider you sign in with.

Polar

Region not confirmed

Subscription billing, as merchant of record.

Receives: Billing email and payment details, which Polar collects and which never reach our servers.

GitHub

Region not confirmed

The source of the code being explained, and where the flyover is posted back.

Receives: Requests made under the installation you authorize.

Vercel

Region not confirmed

Application hosting.

Receives: Request logs and anything transiting the application.

Twilio SendGrid

Region not confirmed

Transactional email, such as the subscription welcome message.

Receives: Your email address and the message content.

PostHog

Region not confirmed

Product analytics.

Receives: Usage events and the account they belong to, not repository content.

Retention and deletion

Different things survive for different lengths of time, and the honest answer is not the same for all of them.

Repository code and diffs

Held only for the length of a render. No durable copy is written; what survives is what the walkthrough is made of — the diagrams and the narration, below.

Rendered flyovers: video, diagrams and narration audio

Kept indefinitely in object storage. Deleting a flyover stops its link resolving immediately, and closing your account removes every database record of it, but neither erases the rendered files themselves. To have those erased, write to us and we will do it by hand.

The record that a flyover was rendered

Kept after you delete the flyover, because the free plan is metered against it and dropping the row would hand back the allowance it spent. It holds the repository and pull request it came from, not the walkthrough.

Account, repository and installation records

Until you close the account, which deletes them outright.

Rate limit counters, which hold an account id or an IP address

Swept once a day, once older than 24 hours — so about two days at the outside.

Links to a rendered flyover

Signed, and expire 24 hours after they are issued.

The gap worth naming plainly: deleting a flyover, or closing your account, removes our records of it and stops every link resolving, but it does not by itself erase the rendered video and audio from object storage. Ask us and we will erase those too. We would rather write that down than let the page imply a deletion the software does not currently perform.

To close an account and have everything associated with it removed, email admin@flyovers.dev.

Who can open a flyover link

A flyover is reachable by its link and is not behind a sign-in, so anyone you send it to can watch it. Nobody else can find it. The id in the URL is a random UUID, which cannot be guessed or counted through; no public page lists flyovers, and your dashboard lists only your own; our robots.txt tells crawlers to stay out of /flyover/, and each flyover page also carries a no-index tag of its own, so a link shared somewhere public does not become a search result. The links to the rendered files are signed and expire a day after they are issued.

Removing the GitHub App

Uninstalling the GitHub App withdraws our access and stops new flyovers being generated. It does not delete the flyovers already rendered, which stay until you delete them or ask us to. If that is what you want, email us and say which repository.

Changes

When this page changes, the effective date at the top changes with it. If a change narrows what we promise here, we will say so before it takes effect rather than after.

Contact

For privacy questions or data requests, contact admin@flyovers.dev.