privacy.

Last updated: 7 November 2026

Who's responsible

New Save Labs, Inc., 131 Continental Dr, Suite 305, Newark, DE 19713, runs Patch and is responsible for your data (the controller, in EU and UK terms).

Where EU or UK law asks why we use your data: we use it to give you Patch (our contract with you), to keep Patch safe and make it better (our legitimate interests), and where the law needs us to. Where we rely on legitimate interests, you can object.

Write to founders@patch.gg about anything on this page.

The short version

• Patch is for adults. You need to be 18 or older to have an account.
• Chats in Patch Desktop are kept, with keys and tokens taken out, so we can fix problems and improve Patch. They're never used for training.
• Play is counted when you're signed in. Makers never see who played.
• An AI model reads the code you release, through service providers, whatever your repo's setting.
• Patch may train its own models on Open work, unless its maker turns that off. Never on Closed source or Private work, and never on chats.
• Your email, name and username go to our analytics provider once you sign in, so our team can find you.
• Most of it is stored in the United States.

Your account

We keep your email, your name, your username, the picture you chose, your Library and who you follow. Once you have a username, your profile is public: your username, your picture, when you joined, and how many people you follow and who follow you. Other people on Patch see your username, never your name or your email. Your name is shown only to you and to Patch staff.

Signing in with Google, Discord or GitHub. We keep that login's id and its tokens, encrypted. From Discord or GitHub we also keep your handle there, to suggest a username. We don't take your picture from a sign-in provider. Each provider has its own privacy terms.

Signing in by email. Resend sends the email, with its link and its 6-digit code. The code is in the subject. The link and code work for 10 minutes, and we store them hashed.

Sessions. Each session keeps your IP address and what your browser or app says it is. A session lasts 90 days after you last used it.

API keys. We store a hash of each key, its name and when it was last used. The keys Patch Desktop makes are named after your computer. While it's open and signed in, Patch Desktop asks for tests waiting for it every 10 seconds, giving your PC's name, and we keep that name with when it last asked. Signing out of Patch Desktop stops its chats and revokes the keys it made.

Your birthday. Nothing asks for it.

Analytics

We use PostHog, in the United States, to see what people do across Patch. It gets page views and named events: signing up and in, downloading Patch Desktop, joining the Mac waitlist (not your address), connecting an agent, what you search for on Discover, games you open, get, play and stop playing, how many pages and clicks a visit took to reach Play, starting to make something, chats started, messages sent (how many, not their text), how each agent turn ended, tests finishing, uploads, releases and their review outcomes, and errors you hit. It also gets when you leave a page, and what you click, change or submit on our pages, with the text of what you clicked but never what you typed.

Session recordings. PostHog records what our pages showed during your visit and what you did on them (where you moved, scrolled and clicked) so we can see where Patch gets in your way. That includes Patch Desktop's window, and the chats in it. What you type into any field is masked before it leaves your device. We don't use heatmaps or surveys.

Once you sign in, your events are joined to your Patch user id, and your PostHog profile keeps your email, name and username so our team can find you. If you aren't signed in, you get an anonymous id and no profile. Before anything is sent, we take query parameters that look like tokens, codes or emails out of the addresses in events and in PostHog's own cookie.

PostHog keeps an id in a cookie and local storage, so your visits are counted as yours.

Browser events reach PostHog through our own domain. Patch Desktop's kept chats go to PostHog directly. PostHog may record your IP address.

Errors

We use Sentry to catch errors in the web app and in Patch Desktop, in the browser, on your PC and on our servers. An error report from a page holds the error, where in the code it happened, the page's address, your browser and the steps just before it, such as pages opened and requests made. One from the rest of Patch Desktop, such as an update, an install, a game's launch or a chat that went wrong, holds the error, where in the code it happened, the app's version, your user ID, your PC's system and graphics card, and the app's last lines of its log. Before a report is sent, we clean its addresses the same way as for analytics, and Patch Desktop takes out keys, tokens, email addresses and your user folder's name. We don't use its session replay, tracing or crash dumps. Sentry also tells our staff when a release is waiting for a person, naming its project, its version and the rules it tripped, never what the review found. Reports from our servers can hold your IP address.

Chats in Patch Desktop

Your chats run on your PC, with your own agent, and the chat itself stays there. Patch also keeps a copy of each chat, to find and fix problems with Patch's instructions and tools, and to improve the notes on games and engines that agents use on Patch.

What a copy holds. What the agent was sent: your messages, your pictures and Patch's instructions. Each model call: what it was given, what it answered, its model and its tokens. Each tool call: its input and its output. So it holds the files the agent reads, the commands it runs and what they print. It also holds how the turn ended, the app's version and your platform. A Private repo's files that the agent reads go in too, and so does anything else the agent opens on your PC.

What's taken out first. Keys and tokens in common formats: Patch keys, some providers' keys, GitHub and Slack tokens, AWS key ids, Google keys, bearer tokens and private keys. Also your home folder's path, which names your account on the PC. Everything else goes as it is, pictures too. A secret in any other format isn't caught.

Where it goes. To PostHog's AI observability, in the United States, and to Patch's own storage in Cloudflare R2. Both file it under the account Patch Desktop is signed in to. AI agents working for Patch read a copy through the providers in "The code you release", on the same asks. When you sign out, chats stop, and anything still waiting to be sent stays on your PC until that account signs in again.

How long. PostHog keeps a copy's main content for 30 days, and other parts, such as a failed tool's error and the chat's title, as long as it keeps events. Patch's own copy has no time limit.

Who looks. Patch's team and AI agents working for it, for those reasons. Agents read only chats kept from 6 November 2026 on, or older ones their owner agrees to. What reaches shared notes is about the game or engine, never your project, code or PC, and a person at Patch approves it first. Chats are never used to train any model.

Only Patch Desktop's chats are kept. A session you run in your own coding agent outside Patch Desktop isn't, even when it uses Patch's tools, pch or a Patch key. What it does on Patch shows up in our ordinary events.

Chat starts. We also record that a chat started: which agent, what kind of chat, the games it's for and the project it became. In a browser game chat, the first words of your first message become the chat's title. Patch gets that title as the name and address of a draft project, and PostHog gets the address when the draft's pages are opened.

Your agent's sign-in

Your agent signs in on your PC with its own sign-in, on your own account with the company that makes it. Patch doesn't receive that sign-in. That company gets what you and your agent send it, under its own privacy terms.

In a chat, your agent gets a Patch key for your account while it works, so it can use Patch's tools as you. When you start a chat with Codex, Patch Desktop also adds Patch's tools to Codex's own settings file, so a chat you carry on in Codex's own app has them too. That file then holds a Patch key that can read and publish as you, in plain text, until you sign out of Patch Desktop.

Discord status

If Discord is open on your PC, Patch Desktop can show what you're playing in your Discord status: the game's name, its maker, its cover and a "play on patch" button. People who can see your Discord profile see it too. Patch Desktop talks to the Discord app on your PC; our servers don't send it. Settings has two switches, both on to start: show what you play, and name the game. Discord's own privacy terms apply to what it shows.

GitHub

If you connect GitHub, Patch's GitHub App can read and write the contents and pull requests of the repos you choose. We keep your GitHub id and login, an encrypted token, which installations and repos you connected, and a public repo's README, and we keep them after you uninstall the app. A chat on a connected repo pushes its commits to GitHub, with GitHub's private address for you as the author, on branches its agent makes and names. One can be named after the chat's title, which for a new chat is how its first message starts. The agent can also open pull requests as you, with titles and descriptions it writes, and merge them if you tell it to. These can repeat what you said in the chat, and anyone who can see the repo on GitHub can see them. GitHub's own privacy terms apply.

Your games and your PC

Patch Desktop looks for games on your PC: in Steam's, Epic's and GOG's records, and in folders you pick. It sends us each game's store id, with no key, to find out which games Patch knows. It fetches some covers from the stores themselves. While a mod's game runs, it reads how long since you last used your keyboard or mouse anywhere on the PC.

Patch Desktop doesn't upload your game files by itself. Three things can still carry some of them:

• the commits your agent makes in a project, which Patch Desktop pushes to the project's repo after each turn, with whatever files the agent committed;
• an agent that reads them (see "Chats in Patch Desktop");
• a test, which records a frame of the game's window every 2 seconds and uploads those frames as contact sheets. Your team and your agent can see them. When a test fails, its error goes to your team with your home folder's path taken out.

Patch Desktop downloads git from GitHub, and installs and updates your agents from their makers' sites, so those sites see your PC's IP address.

Patch Desktop keeps its own key on your PC, encrypted. pch keeps its key in a file only your user can read. For Minecraft, Patch Desktop signs you in to Microsoft through a copy of Prism Launcher on your PC, and that sign-in stays there.

Play

When you're signed in, we record your play, in browser games and in mods Patch Desktop launches. We record the start, one heartbeat a minute and the end. Each holds the game and release, your user id, whether it was Patch Desktop or a browser, an id that client made for your device, the app's version, how many seconds since your last keyboard, mouse, touch or controller input, and whether the game was in view. If a game crashes, we also get what it reported, with your home folder's path taken out, cut short. We also record the first time you get each game.

There's no opt-out. We need this to tell real play from fake and, later, for makers' numbers and for paying makers. Makers will never see who played.

This record doesn't cover people who aren't signed in. PostHog still gets an anonymous event when someone presses Play.

What you publish

Releases. A release's files go to Cloudflare R2, stored by their hash. A browser game's files are served from patchusercontent.com. A release from a commit also gets a zip of that commit, kept beside it.

Repos. Git repos live in Code Storage, and their big files in R2. An Open repo becomes public once a scan of its history finds no secrets. Until then it stays Closed source. Git records a name and an email on every commit, as your git tool set them, and in an Open repo anyone can read them. Going Open publishes all of them. The commits Patch Desktop makes for your chats are signed with your username and a Patch address, not your email. What you write in a change request is public on an Open repo.

Search. Open repos' READMEs are indexed for search.

Spam checks. When a repo is new, we look for signs of spam, such as many repos from a new account. They're recorded for staff to see. Nothing is blocked because of them.

Game requests, shared notes and the Mac waitlist

Game requests. If you or your agent ask Patch to support a game, staff see the request with your account, and answer it.

Shared notes. If you or your agent suggest a shared note, it goes to Patch's team with your account, and to the AI model that checks it, through the providers in "The code you release".

The Mac waitlist. If you join it, we keep your email to tell you when the Mac app is out. You don't need an account.

Copyright notices

If you send a copyright notice, we pass it to the person whose work it names, including your name and contact details, so they can answer it. If you send a counter-notice, we pass it to the person who sent the notice, including your name, address and phone.

Profile pictures

Patch Desktop or your browser crops a picture on your PC and uploads only the crop. Once we've checked it, our media worker on Modal makes copies of it in other sizes, and they go to our public storage under its hash, where anyone can load them. If you remove it, we delete the files unless someone else is showing the same picture, though Cloudflare's cache can keep serving it for up to a day. An upload that never becomes your picture is deleted after a day.

Game saves

A browser game saves in your browser, on the game's own address at patchusercontent.com. Patch's servers don't get those saves. They don't follow you to another PC, and clearing your browser's data clears them. Patch blocks browser games from loading from or sending to other hosts, in its file checks and in the headers it serves them with. A mod's saves stay wherever its game keeps them on your PC.

Counts and logs

Clone counts. When someone outside a repo's team clones it, we count them once a day: a keyed hash of the day and their key or IP address. It can't be followed from one day to the next.

Searches. We log what people search for on Patch, with anything that looks like an email or key taken out, and no account or address, for 30 days.

Asset library searches. We log what's searched for in the asset library and what's opened after it, with the kind of caller and the request's id. We don't log who asked.

Rate limits. We count requests to limit floods. When you're signed in, we count them against your account. When you aren't, we count them against a hash of your IP address, or of its network on IPv6. Counts go within about three hours.

Server logs. Our hosts keep logs of requests, which can hold IP addresses.

The code you release

When you submit a release, we send its files and source to an AI model, through service providers, to check it for security problems. Source can hold personal data, such as names or emails written in the code. The same happens when someone opens a change request on an Open repo.

The path is: our reviewer on Modal, then OpenRouter, then the model on Amazon Bedrock or Google. We ask them not to keep it after answering and not to train on it. They may keep what their safety systems flag or what the law requires, and they keep records of each request without its content, such as its size and time. OpenRouter may also sample requests to sort them into topics, anonymously.

Before that, every file is scanned with ClamAV on our reviewer. On our test environment only, each file's hash is looked up at VirusTotal. No file is uploaded there.

Before a repo goes Open, our reviewer reads its whole history for secrets on Modal. Nothing goes to the model. It keeps each secret's place, kind and first four characters, never its value. It also keeps a list of what going Open would publish, with every author's name and email, for your team to read.

Training

Patch may train its own models on Open work, unless its maker turns that off for the repo. Open work can hold personal data, such as names and emails in code or commits. Patch never trains on Closed source or Private work, or on chats, and never gives or sells anyone's work to others for training. Work taken down for breaking someone's rights is left out. Patch doesn't train any models today. If your personal data is in someone's Open work and you don't want it used this way, write to founders@patch.gg.

Who can see what at Patch

Patch staff can look up an account and see its orgs, projects, logins, devices and keys. Every change staff make is logged with who did it, their IP address and their browser, and that log can't be edited. Only Patch's team and AI agents working for it can read kept chats. Only Patch's team can read PostHog.

Who we share it with

We don't sell your data.

Where your data is

Our database is in Google Cloud's us-east4 region. Our web app runs in Vercel's iad1 region. Our storage is in Cloudflare R2's Eastern North America location. Our reviewer runs on Modal. PostHog is its US cloud. Cloudflare's Workers run close to whoever asks. Code Storage keeps git repos in AWS's us-west-2 region. If you're outside the United States, your data goes there, under our providers' data protection terms, including standard contractual clauses where they apply.

Cookies and what stays on your device

Patch Desktop also keeps files on your PC: which mods are installed, with backups of the game files they replaced; the mod versions you kept; your Discord status choice; and chats waiting to be sent, up to the newest 1,000 turns.

The game host sets no cookies, but a game can set its own. Until patchusercontent.com is on the Public Suffix List, one game can set a cookie that other games on Patch can read.

How long we keep it

Your choices

Today you can: remove your picture, revoke an API key, unlink a login except your last, sign an agent out, keep a repo Private or Closed source, turn training off for a repo, turn your Discord status off or hide the game's name, and keep a mod's version.

You can't turn off play counting while you're signed in. Makers' numbers, and telling real play from fake, depend on it.

Depending on where you live, you can ask to see the data we keep about you, correct it, delete it, get a copy of it, or object to how we use it, and you can complain to your data protection authority. There's no button for this in Patch yet, so write to founders@patch.gg, and we'll answer within 30 days.

Children

Patch is for adults. You need to be 18 or older to have an account. If we learn that an account belongs to someone under 18, we close it. Browsing patch.gg needs no account, and then we keep only what this page says about people who aren't signed in.

Changes

When this page changes, we'll update the date above, and tell you before a big change applies.