Legal
Privacy Policy
What wachiman.dev and the Wachiman software do and do not collect, who receives your data, and how to reach us.
Last updated: 2026-11-02
This policy is effective from 2026-11-01.
Change on 2026-11-02: this policy now names Niway S.A.C. as the operator, relies on Peru’s Personal Data Protection Law (Law No. 29733), lists the rights it gives you and names the Peruvian authority you can complain to. It is not directed at people under 18. It also limits what it says about the website to what the site’s code shows, and describes more precisely what the software does and does not send to NIWAY.
The short version
Section titled “The short version”- The site’s code includes no analytics or tracking scripts and sets no cookies. It has no forms and does not load fonts, scripts or images from other companies.
- Your browser keeps two small items for the site: your light or dark theme choice and the open state of the documentation sidebar. They stay in your browser. We never receive them.
- Our website host, Cloudflare, processes your IP address and basic request details when you visit, as any host does.
- If you email us, we receive your address and what you write, and we use it to answer you.
- Wachiman is software you run in your own GitHub Actions. NIWAY does not run a review service, and the engine has no direct upload endpoint operated by NIWAY. Your code does go to the AI model provider you choose, through your own account, and review comments are posted to GitHub.
- The AI tools that Wachiman starts may send their own usage data to their makers. Wachiman does not turn that off today. Details are below.
Who is responsible
Section titled “Who is responsible”NIWAY (Niway S.A.C., a company incorporated in Peru and based in Lima, Peru) operates wachiman.dev and publishes Wachiman. For privacy questions or requests, write to contact@niway.com. That is the only email address we use for this.
This website
Section titled “This website”What we collect ourselves
Section titled “What we collect ourselves”The site’s code includes no analytics or tracking scripts and sets no cookies. The site has no forms, accounts or comments. The only personal data we handle ourselves is email you choose to send us (see “If you email us”).
The site’s pages load their fonts, scripts, stylesheets and images from wachiman.dev itself. Links to other sites, such as GitHub, only load if you click them.
The search box on the documentation pages runs in your browser. What you type is not sent to us or to anyone else.
What our host sees
Section titled “What our host sees”wachiman.dev is served by Cloudflare. To deliver the site and protect it from abuse, Cloudflare processes technical information about each request, such as your IP address, the page you ask for, and details your browser sends. Cloudflare acts for us in doing this and keeps that data under its own terms and privacy policy. We do not use this information to identify you.
Browser storage
Section titled “Browser storage”The site stores these items in your browser. They are not cookies, they are not used to identify or track you, and they are never sent to a server.
| Name | Where | What it holds | Why | How long |
|---|---|---|---|---|
starlight-theme | localStorage | light, dark, or empty for “follow my system” | Remembers your theme choice between pages and visits | Until you clear your browser’s site data |
sl-sidebar-state | sessionStorage | Which sidebar groups are open and how far the sidebar is scrolled | Keeps the documentation sidebar where you left it | Until you close the tab |
The documentation pages may create the theme item with an empty value when you open them, before you choose anything. Nothing about you is in it.
You can refuse or remove these items at any time by clearing site data for wachiman.dev or by blocking site data for it in your browser settings. The site keeps working, and follows your system’s light or dark setting.
If you email us
Section titled “If you email us”When you write to contact@niway.com we receive your email address, your name if your mail program includes it, the message and any attachments, and the technical headers that email carries. We use them only to read and answer your message and to keep a record of the conversation. We do not add you to a mailing list, and we do not share your message except with the email service that delivers our mail.
We keep correspondence only as long as needed to handle your message and meet legal obligations.
The Wachiman software
Section titled “The Wachiman software”Wachiman is an advisory pull request reviewer. You run it in your own GitHub Actions, with your own API key for the model provider. This section explains where data goes when you do. The full technical detail is in the FAQ and the security policy in the public repository.
What NIWAY receives
Section titled “What NIWAY receives”NIWAY does not operate a review service. In the versions inspected here (v1.3.0 and the main branch on 2026-11-01), the engine has no endpoint that uploads review data or API keys directly to NIWAY. It sends review inputs to your model provider and posts output to GitHub. Content you make public, or put in a repository NIWAY can access, may be visible to NIWAY there. This describes the versions named here; the version you pin determines what runs.
Where your data goes when you run it
Section titled “Where your data goes when you run it”- GitHub. The engine reads pull request data through GitHub’s own tools and your job’s token: the diff, the title and body, the author’s login, earlier review threads, and your review instruction files. It writes only review comments, replies in review threads, and pull request comments. GitHub handles this under your own agreement with it.
- Your model provider. For each review, the engine sends to the provider you chose (Anthropic by default; OpenAI if you use the Codex command line) the diff, your instruction files, the pull request title and body, and earlier review threads. The AI agent can also read other files in the checked-out branch, and what it reads is sent too. This uses your account and your API key. The provider’s terms and privacy policy govern what it does with the data. Wachiman does not control that, and you should decide whether your code may go to that provider before you install it.
- The model’s makers, through their own tools. Wachiman starts the provider’s
command line tool (
claudeorcodex). Those tools are separate programs with their own telemetry. According to their makers’ documentation, they may send usage information, such as performance and usage metrics, to their makers and to the infrastructure providers they use, and Wachiman does not currently switch that off. According to Anthropic, this usage information does not include your code, prompts or file paths. This data does not go to NIWAY. Check your provider’s current documentation for what it covers and how to opt out. - Software downloads. Your GitHub runner downloads Wachiman and its tools from GitHub and, for Claude Code, from Anthropic’s download server. Those servers can see your runner’s IP address.
What stays on your side
Section titled “What stays on your side”- Pull request comments. Reviews appear as comments from the GitHub Actions bot on your own pull requests. The top-level review summary and command answers include a line naming the model and tool version, the effort level and the cost, for example “Claude Sonnet 5.5 via Claude Code · effort high · $0.42” (an illustrative example). Review comments carry hidden markers that the software uses to find its own earlier reviews. If your repository is public, these comments are public.
- GitHub Actions logs. Logs record file names, commit identifiers, errors, and one line per model call with its cost and duration. They stay in your repository until your GitHub retention setting removes them (90 days by default). The software uploads no artifacts.
- Temporary files. While a review runs, the software writes the pull request’s title, body and review threads to temporary files on the runner, and does not delete them. On a GitHub-hosted runner the machine is discarded after the job. On a self-hosted runner they remain until that machine’s temporary folder is cleaned. Claude Code may also keep a local copy of its session on the runner (its documentation says up to 30 days by default).
- No NIWAY database. Wachiman has no account system or NIWAY-hosted repository database. It uses earlier review markers and threads stored in your GitHub repository to continue reviews across runs.
Your choices
Section titled “Your choices”You decide whether to install it, which provider and key to use, which repositories it runs in, and how long GitHub keeps logs. To stop all of this, remove the workflow file. Past comments, logs and the provider’s own records stay until you or they delete them.
GitHub and our public repository
Section titled “GitHub and our public repository”Wachiman’s code, issues and pull requests are on GitHub. Anything you post there, including your username, is public and is processed by GitHub under GitHub’s privacy statement. We, as the repository’s owner, can see it too. Please do not put secrets or personal information in an issue. To report a security problem privately, use GitHub’s private vulnerability reporting on the repository’s Security tab.
Why we handle data, and who receives it
Section titled “Why we handle data, and who receives it”We handle personal data in line with Peru’s Personal Data Protection Law (Law No. 29733) and its regulation. We use the data only for the reasons above: running and securing this website and answering people who write to us. If the GDPR or the UK GDPR applies to you, we rely on our legitimate interests in those purposes, not on consent, because we do not use anything that needs consent. We do not make automated decisions about you.
We do not sell personal information and we do not share it for advertising. The only recipients are our hosting provider (Cloudflare), the email service that delivers our mail, and GitHub where you post publicly. Cloudflare operates a global network, so your data may be processed outside your country; Cloudflare describes its safeguards in its data processing addendum.
Your rights
Section titled “Your rights”Under Peru’s Personal Data Protection Law (Law No. 29733) and its regulation, you have the rights of access, rectification, cancellation and objection over your personal data. That means you can ask us for a copy of the personal data we hold about you, have it corrected, have it deleted, and object to our use of it. If you think we have not handled your request or your data properly, you can complain to Peru’s Autoridad Nacional de Protección de Datos Personales (the national data protection authority).
If the GDPR or the UK GDPR applies to you, you may also have the right to restrict our use of your data, to receive it in a portable form, and to complain to your local data protection authority.
The only personal data we hold ourselves is email correspondence. To use any of these rights, email contact@niway.com from the address you wrote from. We respond within the time limits set by Peruvian personal data protection law. We will ask only for what we need to find your messages.
Cloudflare holds technical records about visitors under its own privacy policy. For what you post on GitHub, use GitHub’s own tools.
This website and Wachiman are tools for developers and are not directed at people under 18. We do not knowingly collect personal data from anyone under 18. If you believe someone under 18 has written to us, email contact@niway.com and we will delete the message.
Security
Section titled “Security”The site is served over HTTPS. We keep the information we hold, which is email correspondence, with the email service that delivers our mail. No method of storage or transmission is perfectly secure, and we cannot guarantee it.
Changes to this policy
Section titled “Changes to this policy”We will change this policy when the site or the software changes in a way that affects it, for example if we add analytics, a form, or any service that receives data from the software. We will update the dates at the top of this page and say what changed at the top of the page. Earlier versions are available on request at contact@niway.com.