Skip to content
Qidu
Request early access

Legal

Privacy Policy

Last updated September 9, 2026

This Privacy Policy explains how Qidu, LLC (“Qidu”, “we”, “us”, or “our”) collects, uses, shares, and protects information about its customers — including the source code, pull requests and documentation we read from the repositories those customers connect.

Who We Are

Qidu is operated by Qidu, LLC, a Delaware limited liability company with its principal office at 131 Continental Dr, Suite 305, Newark, DE 19713, USA. For any privacy question or request you can reach us at hello@qidu.ai.

Qidu keeps technical documentation in step with the code it describes. When a pull request is merged on a repository you have connected, we read the change, work out which documentation pages it has made inaccurate, draft the corrections, and open a draft pull request on your repository for a person on your side to review. For purposes of GDPR and similar laws, Qidu, LLC acts as the data controller for the account data described below, and as a processor for the repository content we read on your instruction, where you are the controller.

What We Read From Your Repositories

This is the part of the policy that matters most, so it is stated plainly. Once you install our GitHub App and connect a repository, Qidu reads the following through a GitHub App installation token:

  • Your source code, in the form of diffs. For each merged pull request on a connected repository we fetch the full unified diff. A diff contains the actual content of the lines your change added and removed. GitHub refuses to serve diffs above roughly 20,000 lines, and a pull request that large is recorded as skipped rather than partly processed.
  • Pull request titles and descriptions, including the author-written prose in them, plus the pull request number, branch names and merge commit SHA.
  • Your documentation content. We fetch the full text of Markdown files (.md, .mdx, .markdown) under the documentation paths configured for the repository. If you keep documentation in a separate repository, we read it from there instead.
  • A listing of file paths in the repository tree, used to suggest where documentation actually lives. This is a list of names; we do not fetch the contents of files that are not documentation.
  • Repository and installation metadata: repository owner and name, default branch, the GitHub account the App is installed on, and the list of repositories that installation can reach.

Qidu does not clone your repository, and outside of the diff of a merged pull request it does not read the contents of your source files.

What We Write To Your Repositories

The GitHub App installation also permits Qidu to write. We use that permission for exactly one thing: creating a branch named qidu/docs-…, committing the proposed documentation edits to it, and opening a draft pull request. Qidu does not merge pull requests, does not push to your default branch, and does not write outside the documentation paths you configured. A person on your side reviews and merges every change.

Information We Collect About You

  • Account information handled by our authentication provider (Clerk), and mirrored into our database: your name, email address, the identity provider you signed in with, your avatar URL, an optional bio, and the time you last signed in.
  • Workspace information: the name, slug, description, country and settings of the workspace you create, its members, their roles, and any invitations you send (each of which stores the invited person’s email address and an expiring token).
  • Billing information: the Stripe customer ID, subscription ID, subscription status and billing email associated with your workspace. Payment method details such as card numbers are collected and stored by Stripe, never by Qidu.
  • Repository configuration: the repositories you connect, their GitHub App installation ID, the documentation paths and locales you set, and whether the connection is active.
  • Operational logs produced by our servers, which record request and job activity including workspace and repository identifiers and error messages.

What We Store, and Where

Everything below lives in a single PostgreSQL database run on Google Cloud SQL in the us-central1 region, alongside our API on Google Cloud Run. The categories that carry your content are:

  • A copy of your documentation corpus. We keep the full text of each Markdown documentation page for a connected repository, up to 600 pages per repository, so that a later job does not have to re-download the whole site. Each page is stored with its git blob SHA and refreshed when that SHA changes; a page deleted upstream is deleted here on the next run.
  • A copy of every proposed edit. For each page we propose to change, we store the full replacement text of that page, the model’s one-sentence rationale, and the evidence chain linking a changed line of code to a line of documentation.
  • A copy of the diff, when drafting is queued. Under the bring-your-own-compute mode described below, the full drafting brief — including the unified diff and the flagged page contents — is stored as a queued request until a drafter picks it up, and the submitted result is stored alongside it.
  • Job records: which pull request triggered the work, its title, the status and any error, a summary of what changed, and the number and URL of the documentation pull request we opened.

How We Use Information

  • To provide and operate the Qidu service.
  • To identify which documentation pages a code change has made inaccurate, and to draft corrections for them using a large language model. This involves sending the pull request diff and the flagged page contents to a model provider — see Subprocessors below.
  • To authenticate users and protect against fraud and abuse.
  • To process subscription billing through Stripe.
  • To send service-related communications, such as sign-in and account emails (sent by Clerk on our behalf) and notices about the service.
  • To comply with legal obligations.

We do not sell personal information, and we do not use your source code, diffs or documentation to train any general-purpose machine-learning model.

AI Drafting: Two Modes

The drafting step is the only point at which your content leaves Qidu’s own infrastructure, and it works in one of two ways depending on how your deployment is configured.

  • Qidu-hosted drafting (the default). The pull request diff, up to eight flagged documentation pages with their full contents, and the evidence for each are sent to Anthropic’s API for inference. The diff is truncated at roughly 120,000 characters and each page at roughly 60,000 characters before the request is sent.
  • Bring your own compute. When a workspace is configured for external drafting, Qidu does not call any model provider. The drafting brief is parked in our database and claimed over an authenticated agent API by a client that you run against your own model entitlement. Your code reaches your model provider under your own agreement with them, not ours.

In both modes, reading the pull request, indexing the documentation and mapping the change onto pages happen on Qidu’s servers, and the resulting draft pull request is opened by Qidu.

How We Share Information (Subprocessors)

We share information with a small set of service providers that help us run the service. We require each subprocessor to handle data under contractual obligations consistent with this policy.

  • GitHub, Inc.: the source of the pull requests, diffs and documentation we read, and the destination of the draft pull requests we open. Access is through a GitHub App you install and can uninstall at any time.
  • Google Cloud Platform: hosting infrastructure (Cloud Run, Cloud SQL for PostgreSQL, Artifact Registry, Cloud Build, Secret Manager). Region: us-central1.
  • Anthropic PBC: AI inference for documentation drafting, using the claude-opus-5 model. Pull request diffs and documentation page contents are sent to Anthropic in prompt context. This applies to Qidu-hosted drafting only; under bring-your-own-compute no request is sent to Anthropic by us.
  • Clerk: user authentication and identity management, including the account emails sent on our behalf.
  • Stripe: subscription billing and payment processing.
  • Vercel: hosting and aggregate traffic measurement for our public website and web front end.

We may also disclose information if required by law or in response to valid legal requests by public authorities.

Data Retention

We do not currently run an automatic expiry over stored repository content. Diffs, documentation copies, proposed edits and job history are retained for as long as the connection that produced them exists. They are deleted when you disconnect the repository, when the workspace is deleted, or when you ask us to delete them — each of which is an immediate and permanent deletion from our database. Uninstalling the GitHub App pauses processing but does not by itself delete stored data. The Data Deletion page sets out each path and exactly what it removes.

Data Deletion

You can delete your data at any time. Disconnecting a repository and deleting a workspace are both self-service inside the product and take effect immediately; account deletion and any other request is handled by emailing hello@qidu.ai with the subject “Data Deletion Request”. Full instructions are on our Data Deletion page.

Your Rights

Subject to applicable law, you have the right to access, correct, update, port, or delete the personal information we hold about you, and to object to or restrict certain processing.

If you are in the European Union, the United Kingdom, or another jurisdiction with similar laws, you also have the right to lodge a complaint with your local data-protection authority. California residents have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what categories of personal information are collected and to request deletion.

To exercise any of these rights, email hello@qidu.ai. We respond to verified requests within thirty (30) days.

Cookies

The Qidu website uses a minimal set of cookies and similar technologies that are strictly necessary to deliver the site, together with aggregate traffic and performance measurement provided by our hosting provider. We do not use advertising or cross-site tracking cookies. The Qidu product (the signed-in application) uses cookies for authentication via Clerk and to remember which workspace you are working in.

Children’s Privacy

Qidu is not intended for children under thirteen (13). We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact hello@qidu.ai and we will delete it.

Security

We implement appropriate technical and organizational measures to protect information against unauthorized access, alteration, disclosure, or destruction. GitHub App credentials and other secrets are held in Google Secret Manager rather than in our source code; GitHub installation access tokens are short-lived, held in memory only and never written to our database; traffic is encrypted in transit using TLS; incoming GitHub and Stripe webhooks are verified by signature before we act on them; every query is scoped to a single workspace so one customer cannot reach another’s data; and access to production systems is restricted to authorized personnel.

International Data Transfers

Qidu is operated from the United States. If you access the service from outside the United States, your information may be transferred to, stored, and processed in the United States and other countries where our service providers maintain facilities. Where required, we rely on appropriate transfer mechanisms such as the European Commission’s Standard Contractual Clauses.

Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes we will notify customers by email and update the “Last updated” date at the top of this page.

Governing Law

This Privacy Policy is governed by the laws of the State of Delaware, United States of America, without regard to its conflict-of-laws principles.

Contact Us

Questions, comments, or privacy requests can be sent to hello@qidu.ai or by mail to:

Qidu, LLC
131 Continental Dr, Suite 305
Newark, DE 19713
USA