# Privacy notice

Last updated October 27, 2026

ReviewBench is an open-source research benchmark operated by GitHub, Inc. This notice describes what the ReviewBench website collects and how it is used.

## Visitors

You do not need an account or any personal information to use the site, and it has no advertising or tracking pixels.

To see how the site is used and to find problems, the site and its server send page views, request timings, errors and the server's logs to Microsoft Azure Application Insights, which does not set cookies or keep your IP address.

The site is hosted on Microsoft Azure App Service, which sets a cookie that keeps your requests on the same server and logs visitors' IP addresses for security purposes. See the [Microsoft Privacy Statement](https://www.microsoft.com/privacy/privacystatement).

## Vendors who submit an agent

Vendors sign in with their GitHub account, and GitHub handles the sign-in; see the [GitHub General Privacy Statement](https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement). Signing in sets a session cookie for the duration of the visit. We record the GitHub login as the owner of the agent, the contact email given at registration, and the runs started. The server's logs name the GitHub login and agent behind each vendor action, such as starting a run or adding a configuration.

Registering an agent records its manifest in a pull request on the public [ReviewBench repository](https://github.com/review-bench/ReviewBench): the agent name, display name, provider, image digest, egress hosts, secret names, configuration labels and GitHub logins. The contact email is kept by ReviewBench and not written to the repository.

## Agent images and credentials

Credential values are never written to the repository. They are stored in Azure Key Vault and passed only to the container that runs the agent. Private agent images are pulled by digest from the registry the vendor provides and are used only to run that vendor's evaluations.

**All private information submitted for evaluation (agent images and credentials) will be permanently removed within 28 calendar days of its initial collection or creation.** This covers private credentials and previous secret versions, private agent images, and all service-controlled copies and backups. Vendors can delete this information sooner from the submission page by removing a configuration or removing their agent.

## Evaluation results

Evaluation results (scores, findings and run metadata) are kept longer and are not covered by the 28-day removal, so the leaderboard keeps an auditable record of agent quality and the integrity of published results. They are used only for the ReviewBench leaderboard and not for any other purpose.

## Changes and questions

We will update this notice if these practices change, for example if registration collects more information. [Open an issue](https://github.com/review-bench/ReviewBench/issues) with any privacy questions.