LAST UPDATED 2 OCTOBER 2026

Privacy

Bounty Operator reviews files you choose to provide. This page describes the hosted website. The open-source command-line kit runs on your own machine.

Your files and API key

File selection, privacy checks, and prompt export run in your browser. A hosted AI review sends the selected files, review instructions, model name, and API key through our Cloudflare server to the provider you select: OpenAI or OpenRouter. Only run a review if you have permission to share that material with the provider. We do not save those files, instructions, keys, or review results in our database or application logs. They are processed temporarily in memory. Closing the tab clears the workspace.

The chosen AI provider processes your request under its own terms and retention policies. We cannot control its storage. A local privacy check can miss sensitive information; inspect files yourself. Exporting a prompt does not contact an AI provider.

Account records

We store a random account identifier, passkey public keys, passkey counters, a hashed recovery code, hashed session and AI connection tokens, connection labels and last-use times, creation and expiry times, and billing references. Passkey private keys and device biometrics stay with your authenticator. A necessary session cookie keeps you signed in for up to 30 days.

Usage and service protection

We store whether a review is running, completed, or failed, its account identifier, review profile, web or MCP channel, and timestamps. We keep these records for up to seven days to enforce daily allowances and concurrency limits. We hash the request's IP address for short-lived abuse limits; these records expire within a day. Expired sessions, challenges, and rate limits are removed daily. Operational logs contain request paths and generic error notices; the application does not log review bodies, API keys, or Stripe event bodies.

Cloudflare hosts the website and may process request metadata, including IP addresses, under its own policies. We use no advertising cookies, tracking pixels, or third-party analytics on the page.

GitHub imports and AI clients

A GitHub import sends the selected file link and any read-only GitHub token directly from your browser to api.github.com. It reads the selected file at an exact commit; it does not upload a repository to our server. The GitHub token is held only in tab memory until disconnected or the tab closes. GitHub processes the request under its own policies.

The local MCP server receives only content supplied by your AI client. Local privacy checks and request preparation do not contact our hosted server or an AI provider. Your AI client may send that tool result to its own model provider under its own policies. Hosted MCP reviews send selected material and the locally configured provider key through our server in the same way as a website review. AI connection secrets are shown once, stored only as hashes by our server, expire after 90 days, and can be revoked in the portal. Recovered accounts and Sign out all devices revoke all AI connections.

Payments

Stripe processes subscriptions and payment details. Our database records the Stripe customer and subscription identifiers, status, and paid access expiry. Card details are entered on Stripe's website and do not pass through our application. We retain billing references as required for support and payment reconciliation; Stripe retains its own financial records.

Deletion and support

You can delete a free account from the account panel. To delete an account that has used billing, cancel the subscription through Manage subscription and contact support@polytraderbot.com. Account deletion does not remove Stripe records that must be retained. For a non-sensitive technical issue, use the project support channel. Do not post code, API keys, private reports, recovery codes, or payment details in a public issue.

Changes

We will update this page when processing changes. The date above identifies the current version. Material changes to billing terms will apply only after appropriate notice.