Privacy¶
This page describes what the Commit Check GitHub App reads, what it keeps, and what it never sees. The command-line tool, the pre-commit hooks and the GitHub Action run entirely inside your own environment and send nothing anywhere; this page is about the hosted App only.
What the App reads¶
When you install the App, GitHub grants it these permissions and nothing else:
| Permission | Level | Used for |
|---|---|---|
| Metadata | read | Knowing which repositories it is installed on |
| Contents | read | Fetching the commits under test and the repository's cchk.toml / commit-check.toml |
| Checks | write | Posting the Commit Check result on each commit |
| Pull requests | read | Listing the commits of a pull request |
On every push and pull request event the App fetches the commits under
test into a temporary directory. The fetch is shallow and filtered
(--filter=blob:none), so what comes across the wire is the commit
metadata — message, author, timestamps, the list of paths each commit
touches — plus the contents of the repository's configuration file, if it
has one. Configuration files are the only file contents the App ever
reads, and the only ones that ever reach the temporary directory, its
object store included. The rules are evaluated, the result is posted as a
check run, and the temporary directory is deleted before the event is
considered handled.
Two more configuration files can be read, and nothing else. For a repository
that has no configuration file of its own, the App reads its owner's shared
one from the owner's .github repository (an organization's or a user's),
at the same paths, with the same permission. When a configuration file
inherits from another repository with a github: address, the App fetches
that one file too.
For a private repository owned by an organization, the App also asks GitHub which Marketplace plan that organization is on, to decide whether the Team plan applies. That request carries the organization's account id and nothing about the repository.
What the App keeps¶
Nothing. The App has no database and stores no repository content, commit messages, author details or configuration. Each event is processed from the webhook payload and discarded.
The hosting platform retains operational logs for a short period. A log line carries the webhook delivery id, the commit SHA being checked, the id of the check run created and, when a check could not run, the error text the tool produced — never an author name or email, and never file content.
What the App never sees¶
- Your source code beyond the configuration file named above
- Repositories the App is not installed on
- The contents of a delivery whose signature does not verify. GitHub signs the raw request body, so the App has to receive that body to check the signature; an unsigned or mis-signed delivery is rejected at that point, before anything in it is parsed or acted on
Where it runs¶
The App runs on Fly.io in the ams (Amsterdam) region.
Traffic between GitHub and the App is encrypted in transit; GitHub signs
every delivery and the App verifies the signature before doing anything
else.
Contact¶
Questions about this page or the App's data handling: open an issue.
Last updated: 2026-09-05.