New
Introducing React Bench, see how different models perform on React code

Data Use & Privacy Overview

Last updated August 29, 2026

If you have any questions or feedback, please email us at founders@million.dev. For more information about how we collect, use, disclose, and process personal data, see our full Privacy Policy.

This overview explains how React Doctor handles GitHub repository data while reviewing pull requests. React Doctor is a static analysis service for React code.

What React Doctor receives

When the GitHub App is installed or a supported pull request event occurs, GitHub sends React Doctor webhook data such as repository, installation, pull request, commit, and comment information. React Doctor uses a GitHub installation token to access the repositories selected for the installation.

How pull requests are analyzed

For each review, React Doctor downloads GitHub tarball archives for the pull request head and base revisions. Those archives are written to an isolated Vercel Sandbox, extracted, and analyzed with React Doctor, which compares diagnostics between the base and head revisions so it can report issues newly introduced by the pull request.

What React Doctor stores or publishes

React Doctor does not maintain a database of your source code. Repository archives and extracted files are used for the review run and the sandbox is stopped after analysis. Review output is posted back to GitHub as check run status, inline review comments, and a pull request summary comment. Those GitHub artifacts may include file paths, line numbers, diagnostic rules, diagnostic messages, project metadata such as framework or React version, and aggregate health scores.

Dashboard data

The dashboard uses GitHub installation data to show the repositories connected to React Doctor. It returns repository identifiers, full names, visibility, repository URLs, and the installation account login. Dashboard responses are sent with no-store cache headers.

Training and AI providers

Pull request reviews are produced by static analysis with React Doctor, not by an AI model provider, and the code in a reviewed pull request is not used to train models.

Separately, with your explicit opt-in, React Doctor's tools may contribute de-identified data derived from your code to help improve our products and services. This is off by default and can be turned off at any time, and we do not attempt to re-identify it. See our Privacy Policy for details.

Service providers

React Doctor uses GitHub to receive installation and pull request data and to publish review results. React Doctor uses Vercel Sandbox to run the isolated static analysis job. Operational logs may include errors and metadata needed to operate and debug the service.

Command-line interface telemetry

The React Doctor command-line interface (CLI) reports crashes, run traces, and usage metrics. This data helps maintainers fix defects and understand product use. The CLI does not send your file contents or code snippets.

Where telemetry goes

The CLI uses these telemetry destinations:

  • Sentry: Receives crash reports, stack traces, and data for issue grouping. Sentry tracing is disabled. Read the Sentry privacy policy.
  • Axiom: Receives run traces and usage metrics through the OpenTelemetry Protocol (OTLP). The published CLI includes an ingest-only credential limited to the telemetry datasets. Read the Axiom privacy policy.
  • Your OTLP collector: Receives telemetry when you set both REACT_DOCTOR_OTLP_ENDPOINT and REACT_DOCTOR_OTLP_AUTH_HEADER. This collector replaces Axiom export.

What telemetry contains

CLI telemetry can contain:

  • Environment: CLI version, operating system, processor architecture, Node.js version, package manager, terminal type, and whether the run is interactive.
  • Invocation: Command, scrubbed arguments, scrubbed working directory, and whether the run came from a local terminal, continuous integration (CI), a Git hook, or a coding agent.
  • CI context: Provider, event name, runner operating system, official GitHub Action use, and forwarded Action settings.
  • Project shape: Framework, React version, TypeScript use, project size, and configuration shape.
  • Scan results: Rule names, severity, category, counts, affected file count, score, check outcomes, cache state, worker settings, and timing data.
  • Crash data: De-minified React Doctor stack frames and project filenames, without captured local variables.

How telemetry is scrubbed

React Doctor replaces the home-directory and operating-system username part of paths with ~. It also redacts known secret and email patterns. Repository names, directory names, and filenames can remain after this process. The environment data is pseudonymous, not fully anonymous.

Sentry events remove user identity, server name, device name, and captured local variables before transmission. React Doctor does not intentionally attach a GitHub owner, repository remote, branch name, file contents, or code snippets.

How to disable CLI telemetry

Disable Sentry, Axiom, and user-configured OTLP export by running npx react-doctor@latest --no-telemetry. For scripts and continuous integration, set REACT_DOCTOR_NO_TELEMETRY=1.

The @react-doctor/api package does not initialize or send CLI telemetry.