Privacy policy

Who we are

Patch is a feedback tool for client websites, operated by Sim Studio BV, a Belgian company ("we", "us"). Your clients pin comments on a live site, and Patch turns that feedback into pull requests using a coding agent that runs on your own credentials. Sim Studio BV is the controller of the personal data described in this policy. You can reach us at privacy@usepatch.dev.

The data we collect

• Account data. When you create a Patch account we store your name, email address, and sign-in details. For security, sessions record technical details such as your IP address and browser. If you connect GitHub, we store your GitHub username and the installation details needed to access the repositories you link.
• Client feedback. When someone leaves feedback through the widget, we store the name and email address they enter, their comment, and context about the annotated page: the URL, the selected element, its position, and nearby page details such as visible text. The widget does not capture screenshots. Patch does not verify client identities; this information is provided by the person leaving the feedback.
• Repository data. Patch accesses the repository linked to a project, scoped to that project, so your coding agent can propose changes. Repository contents are cloned into an isolated, short-lived environment for the duration of a run. We keep the run's results, such as the proposed change and run logs, but not a copy of your repository.
• Agent credentials. If you bring your own coding agent account, we store the credentials you provide and use them only to run the agent on your behalf.
• Usage data. This website uses cookieless analytics (Vercel Analytics) that collect aggregated, anonymous page statistics. They set no cookies and do not track you across sites.

Cookies and local storage

This website sets no cookies. The Patch app uses essential cookies only, to keep you signed in. On sites where the widget is installed, it remembers a commenter's name and email in the browser's local storage so they don't have to retype them; that information stays in their browser and is not used for tracking. We do not use advertising or cross-site tracking cookies anywhere.

How we use your data

We use the data above to provide and operate Patch: showing feedback to the right project, briefing your coding agent, opening pull requests, keeping accounts secure, responding to support requests, and sending service emails about your account or projects. We do not sell personal data and we do not use it for advertising.

Legal bases

Where the GDPR applies, we process personal data to perform our contract with you (providing Patch), for our legitimate interests (securing and improving the service), and with your consent where the law requires it.

Who we share data with

We share data only with the service providers that run Patch: Vercel (hosting, analytics, and the isolated environments runs execute in), Neon (database hosting), GitHub (repository access and pull requests), Resend (transactional email), Inngest (background job processing), and your coding agent provider, such as Anthropic, OpenAI, or Anysphere (Cursor), which receives the feedback content needed for a run under your own account. Each processes data to provide their service, nothing more.

International transfers

Some of these providers process data in the United States. Where they do, transfers rely on safeguards such as the EU-US Data Privacy Framework or standard contractual clauses.

Retention

We keep your data for as long as your account is active. Feedback and run history stay attached to the project they belong to. When you delete your account, or ask us to, we delete the associated personal data within a reasonable period, allowing for residual copies in backups.

Your rights

You can ask us to access, correct, delete, or export your personal data, and you can object to or restrict certain processing. Email privacy@usepatch.dev and we will respond. You can also lodge a complaint with your local data protection authority.

Children

Patch is not directed at children under 16 and we do not knowingly collect their data.

Changes to this policy

If this policy changes, we will post the new version here and update the date at the top of this page.