Absolute visibility into what we track — and what we don't.
We request the minimum permissions possible. You can verify this directly in your GitHub settings.
What FlowMetrics can see
-
Pull request titles, numbers, and states (open / merged / closed)
-
PR creation, merge, and close timestamps
-
Review events — who reviewed, when, and what type (approved / changes requested)
-
PR size metadata — lines added / removed, files changed, commit count
-
Author GitHub username and ID
-
Only repositories you explicitly install the GitHub App on
What FlowMetrics cannot see
-
Source code, file contents, or commit diffs
-
Secrets, environment variables, or credentials
-
Issues, comments outside of PRs, or wikis
-
CI/CD results, Actions logs, or deployment records
-
Repository settings or configuration
-
Any repository it is not explicitly installed on
GitHub App permissions requested
You can revoke access at any time from github.com/settings/installations.
How your data is protected
Uses GitHub OAuth
No need to create a new username/password, login directly with GitHub for seamless transition between FlowMetrics and GitHub.
Secure repository authentication
Repository access uses the same permissions as GitHub. Your team will only see what you want them to see, no additional setup required.
Read-only access
FlowMetrics has only read-only access to your pull request metadata. It cannot see your source code, diffs, secrets, change memberships, or create commits.
Slack posts only where you choose
The weekly digest and stalled-PR nudges post to the one channel you pick for each repository: metric values, plus the number, title and author username of each stuck PR. Disconnect at any time from the repository's Integrations tab.
Peer benchmarks, anonymous by design
Benchmarks compare your team with teams of a similar size. Here is exactly what goes into them.
Only aggregated figures
We publish statistical summaries, such as the median time to first review for teams with 6–15 active authors. Never repository names, organization names, people, pull request titles or code.
At least 10 repositories from 5 organizations
A figure is published only when it combines at least 10 repositories from at least 5 different organizations, so no single team can be identified from it.
Who contributes
Organization installations contribute by default; personal accounts don't. Peer groups also include public open-source repositories, measured from their publicly available pull request metadata.
Opt out at any time
An organization admin can stop contributing in billing settings and still see their own benchmarks. Your data is deleted and left out of the next nightly computation, and the same happens when you uninstall.
Stop guessing. Start measuring.
Connect your GitHub account and have answers in minutes.
Generate Your Dashboard →Reads pull request metadata only. We cannot read your source code.