Privacy

FirstPR is operated by Nishal K and Anan Shaji (NKcodex / DuoMatter), based in India. Contact nishal@nishal.dev. The public site in this project is hosted at firstpr.nishal.dev. A self-hosted copy is operated by whoever runs that copy.

There is no account and no login. This repository does not set cookies and does not include a product analytics SDK.

In the browser, the site stores:

• Recent search strings, up to five, under the key firstpr-recent-searches.
• The UI language under firstpr-ui-lang, and the older key firstpr-lang if it was set before.
• The colour theme under the key theme, written by the theme library.

On the server, a request can include a GitHub username, a repository name, an issue number, a pull request URL, or a diff you paste. Explain, hints, difficulty, and review send the issue or pull request text the feature needs (title, body, file paths, short file previews, and the diff or patch) to the model configured for that task.

FirstPRbot, when installed, receives GitHub webhook payloads for issue comments and for pull requests that are opened or updated. Those payloads include the repository, the issue or pull request number, the comment text, and the sender login GitHub provides. The app posts a comment back on that issue or pull request.

The data is used to match public beginner issues, explain an issue, score a pull request, and, if the GitHub App is installed, post that same guide or score on GitHub. When the Algolia search key is set, the words in the search box are sent from the browser to Algolia. When it is not set, search suggestions call GitHub’s API from the server. Recent searches and language and theme stay on your device so the page can remember them.

The site code runs on the host you deploy it to. The deployment described in this repo is Vercel. GitHub API calls are made from the server with a token that is not sent to the browser. Model calls are made from the server.

There is no database in this code. A README note about Neon Postgres is not implemented: nothing reads DATABASE_URL.

Named only where the code calls them:

• GitHub, for public repository, issue, and pull request data, and for FirstPRbot webhooks and comments.
• OpenAI, at api.openai.com unless OPENAI_BASE_URL is set to another host. Explain, hints, review, difficulty, and the file-pick fallback send the text those tasks need. Logs record the task name, model name, token counts, and duration, not the prompt.
• Neysa Gemma and Neysa Qwen, only if those keys and URLs are set. They are asked to pick files from path lists and short previews.
• SerpAPI’s Google search, only if SERPAPI_KEY is set. The query is a short topic derived from the issue, not your GitHub password or token.
• Algolia, only if ALGOLIA_APP_ID, NEXT_PUBLIC_ALGOLIA_APP_ID, and NEXT_PUBLIC_ALGOLIA_SEARCH_KEY are set. The browser sends the search text to that Algolia application. A scheduled job uses the admin key on the server to store public issue fields: title, repository, URL, labels, language, star count, created and updated times, comment count, and whether the issue is assigned. The admin key is not sent to the browser. If those variables are absent, this call is not made.
• Vercel, as the host of the public deployment. This repo does not install Vercel Analytics.

The server cache is an in-memory map. The default lifetime is ten minutes, and the map is discarded when the process stops. This code does not set a retention period for host logs. Console logs can include webhook event names, repository coordinates, error messages, and model token counts. Demo JSON files under data/demo are written only when RECORD_DEMO=1 and the process is not production. When Algolia is configured, indexed issues stay until a later sync deletes ones GitHub reports as closed or assigned. This app does not send the five recent-search strings to Algolia except when you type them again.

Browser storage stays until you clear it. Recent searches hold at most five strings. You can clear them from the search menu.

Because there is no account, there is no profile stored for us to export. You can delete the browser keys above in your browser. For a copy of a comment FirstPRbot posted, use GitHub. To ask about server logs or a self-hosted copy, email nishal@nishal.dev.

If the Digital Personal Data Protection Act, 2023 applies, you may ask the operator to access, correct, or erase personal data they hold, and to nominate someone to exercise those rights, to the extent the data exists. If the GDPR applies, the same request covers access, correction, erasure, restriction, and objection where those rights fit a stateless service. We do not sell personal data. There is no automated decision that opens a pull request or rejects one; the score is a checklist shown to you or posted as a comment.

The app is not aimed at children and does not ask for age. Do not send a child’s personal data in an issue or pull request body.

If this page changes, the date at the top changes with it. The page describes this repository as of that date.

Nishal K and Anan Shaji (NKcodex / DuoMatter), India. Email nishal@nishal.dev.