GitHub Builder (Githubuilder) privacy

Applies to the GitHub Builder web app (repository name Githubuilder): a web app hosted on Vercel that offers one-time “runs” which push backdated commits to repositories on your own GitHub account, executed by a background worker on our own server: free beta runs today, and paid runs once purchases open. The app’s footer and its /privacy page link here.

This service is operated by llab08, Hong Kong, and these terms are governed by the laws of Hong Kong. The section below explains this product’s data handling and current availability.

Free beta runs are on; purchases are off. As of the date below each account can start up to two free beta runs in any 24 hours, within a shared daily limit for all accounts, and no run can be bought. The purchase and AI generation paragraphs describe processing once purchases open. Advanced runs will use Anthropic as the AI model provider, through our gateway, as described below.

Account

You sign in with Google or with a link sent to your email address, on our own authentication server at supabase.llab08.com, the shared llab08 sign-in that other llab08 products also use. We keep the account id, the email address and, when the sign-in provider supplies them, a display name and avatar URL. There is no password to store.

Free beta runs

A free beta run writes 200 commits, dated over the last four years, into one empty repository that you have created on GitHub. It uses no AI. To apply the limit we keep a record of each free run with your account id and its time; it is removed after two days, and until then it stays even if your run history is deleted.

Purchases

Paid runs are one-time purchases processed by Stripe. Card details are entered on Stripe’s checkout page and never reach us. We keep the Stripe customer, checkout-session and payment identifiers, the amount and currency, and the status of each run so that it can be shown on your account page.

Running a job: your GitHub token

To start a run you type a GitHub username, the email address that should appear on the commits, a fine-grained personal access token (classic tokens are refused) and, depending on the tier, a date range and the name, language and description of each repository. The token is encrypted the moment it reaches our server, held only while the run is queued or running (including across worker restarts and retries), used by the worker solely to create or write to repositories and push commits on your GitHub account, and deleted when the run finishes or fails. It is never written to logs. Use a short-lived token and revoke it on GitHub afterwards. The username, email address, dates and repository names, languages and descriptions are kept with the run record so you can see what was done.

If any run fails, free or paid, the worker’s error log on our server records your GitHub username and the commit email address you typed, so that the failure can be traced. We have not confirmed that anything rotates or deletes that log, so assume an entry stays on our server until a deletion request at the address below removes the entries about your runs.

AI generation (Advanced runs)

When Advanced runs are enabled, the worker sends the language (up to 50 characters) and description (up to 500 characters) you enter for each of the two repositories to llab08’s own AI gateway at sub2api.llab08.com. The gateway runs on our server, and connections to it pass through Cloudflare. It passes the text to a third-party AI model provider, which plans the repository’s files; the worker then sends the language with each planned file’s path and purpose, as written by the model, the same way to generate that file’s code. Repository names, your GitHub username, the commit email address and your GitHub token are not sent to the gateway or the provider. If a generation step fails, the worker’s error log on our server records the language and the description or file path, and for a failed file also the repository name; that log is kept and cleared as described under running a job.

The AI model provider used through our gateway is Anthropic, with its Claude models. Another provider may be used later only after this section is updated. Anthropic processes the text under its own terms; we make no promise on its behalf about how long it keeps it or whether it uses it to train models.

Emails

The sign-in service sends the sign-in link emails, delivered by Resend. When the app’s own email is switched on, it also sends one welcome email after an account is created and a thank-you email after a purchase, through Resend; as of the date below it is not switched on. No newsletters.

No ads, no analytics

The app shows no advertising and, as of the date below, loads no analytics or other third-party tracking script. If a future version adds a cookie-less analytics script, this section is updated first.

Hosting and retention

The web app runs on Vercel; the worker and the database run on our own server. Hosts may keep short access logs; we do not use them to identify anyone. Run records stay with your account until you ask us to delete them: write to hello@llab08.com from the address you sign in with and we remove your GitHub Builder profile, your run history and any error-log entries about your runs. Your shared llab08 sign-in identity is kept unless you also ask us to erase it, as explained under shared sign-in retention and erasure.

Contact: hello@llab08.com · Updated 11 October 2026 · All privacy notices