Legal

The privacy policy, terms of service and copyright policy for LGTM.lol. One document covers the website, the API, the MCP server, the Agent Skills, the browser extension and the iOS and Android apps (together, "the Service"). Operator: LGTM.lol. Contact: [email protected].

Contents	1. Privacy Policy · 2. Terms of Service · 3. Copyright · 4. Contact
Last updated	2026-10-26
In effect since	2016-02-03

1. Privacy Policy

This policy explains what the Service collects, why, who it is shared with and the choices you have. It applies to everyone who uses the Service, wherever they are. Where the GDPR, the UK GDPR, the CCPA or the Japanese Act on the Protection of Personal Information applies, the sections below say how.

1.1 What we collect

The Service works without an account. Browsing and fetching images collects nothing beyond the technical data in the last row. The rest applies only when you choose to sign in or post.

Data	When	Why
GitHub user ID and username	You sign in with GitHub	To create and recognise your account. We request only the `read:user` scope, store only your ID and username, and never ask for your email address or repository access.
Wallet address and signed message	You sign in with a wallet, or pay for a premium image	To recognise your account and to settle payments. A payer address appears on the public page of the image it paid for.
Passkey public key and counter	You register a passkey	To verify sign-in. The private key never leaves your device.
Images you post and the time of posting	You post an image on the site, in the app, via the API or via a Skill	To publish the image. Images are public, unlisted premium images are served to paying clients.
Text prompts	You use the image generator	To generate an image. The prompt is sent to OpenAI's image API and to our moderation channel.
A random key identifying the app install, stored as a one-way digest	You post, report or block from the iOS or Android app	So that images posted from the app can be reported, and their poster blocked by other users or barred by us. The key is made up by the app, never leaves it except with those requests, and identifies the install, not you. The digest of a poster's key is public with the image.
Photo library access	You post from the iOS or Android app	To let you pick an image. Only the image you select is uploaded, and only when you confirm.
IP address, user agent, requested URL	Every request	Rate limiting, abuse prevention, security and short-lived server logs.

We do not run advertising or third-party analytics on the Service, and we do not collect your name, email address, payment card or precise location.

1.2 Legal basis (GDPR / UK GDPR)

Performance of a contract	Accounts, sign-in, posting, premium image delivery and payment settlement.
Legitimate interests	Rate limiting, abuse prevention, moderation of posted images, keeping the Service secure and available.
Consent	Photo library access in the apps, which you grant in the system dialog and can withdraw in your device settings.
Legal obligation	Responding to lawful requests and keeping records the law requires.

1.3 Who we share it with

We do not sell personal information and have not done so in the preceding twelve months. We do not share it for cross-context behavioural advertising. We do share data with the providers that run the Service, each for its own purpose only:

Provider	Purpose and data
GitHub	Sign-in. GitHub tells us your user ID and username when you authorise the Service.
Amazon Web Services (Tokyo region)	Storage of posted images and the database.
IPFS	Images posted through the IPFS option are published on the IPFS network and can be copied by any node. They cannot be recalled by us once pinned elsewhere.
Cloudflare	Delivery, caching and protection of the Service. Cloudflare sees the IP address of every request.
OpenAI	Generator prompts, for image generation.
Base and Polygon blockchains, x402 facilitator	Premium payments and NFT mints are recorded on public blockchains, which show wallet addresses, amounts and timestamps to everyone, permanently.
Discord (operators only)	A private channel notifies the operators of new posts, sign-ins and generator prompts, with the username and a link, so posted images can be reviewed.
Authorities	When required by law, a court order or a valid government request, or to protect the rights and safety of users or the public.

1.4 International transfers

The Service is operated from Japan and its primary storage is in Japan. Japan holds an adequacy decision from the European Commission and the United Kingdom. The providers above may process data in the United States or elsewhere; such transfers rely on the providers' standard contractual clauses or equivalent safeguards. IPFS and public blockchains are distributed worldwide by design.

1.5 Cookies

The Service sets two first-party cookies and nothing else. There are no advertising or tracking cookies. Blocking them in your browser is fine, but you cannot stay signed in without the session cookie.

`lgtm_session`	Keeps you signed in. Expires after 30 days of inactivity.
`lgtm_theme`	Remembers your light or dark theme choice. Expires after one year.

1.6 Retention

Account data	Until you ask us to delete the account.
Posted images	Until removed by you, by the operators, or on a valid takedown request. Copies on IPFS and in third-party caches may persist.
IP addresses for rate limiting	In memory for about one hour, not written to the database.
Server and access logs	Rotated within 30 days.
Blockchain records	Permanent, outside our control.

1.7 Your rights

Wherever you live, you can ask us to tell you what we hold about you, correct it, delete it, give you a copy, or stop processing it. Residents of the EU, EEA, UK, Switzerland and California have these rights by law, and Californians also have the right not to be discriminated against for using them. We do not sell or share personal information, so there is nothing to opt out of under "Do Not Sell or Share".

To exercise a right, email [email protected] from an address you can prove you control, or with a signature from the wallet or GitHub account in question. We answer within 30 days (45 days for CCPA requests). You may also complain to your local data protection authority.

Two limits apply. Data written to a public blockchain cannot be deleted by anyone. Images published to IPFS can be removed from our gateway and pin, but copies held by other nodes are outside our reach.

1.8 Deleting your account

Email [email protected] and we will delete your account record and, if you wish, the images you posted. You can also revoke the Service's access in your GitHub settings or remove the passkey from your device at any time.

1.9 Children

The Service is not directed to children under 13 (under 16 in the EU and UK) and we do not knowingly collect their data. If you believe a child has posted or signed in, contact us and we will remove the data.

1.10 Security

Traffic is encrypted in transit. Passwords are never collected, sign-in relies on GitHub, wallet signatures or passkeys. Access to the production systems is limited to the operators. No system is perfectly secure, and we will tell affected users and the relevant authority of a breach where the law requires it.

2. Terms of Service

By using the Service you agree to these terms. If you do not agree, do not use it. If you use the Service on behalf of an organisation or an automated agent, you agree on its behalf.

2.1 The Service

LGTM.lol hosts images meant to be pasted into code reviews. The free collection is available through the website, the API, the MCP server, the Skills, the extension and the apps without an account or API key. A separate premium collection is sold per request over the x402 protocol. We may change, suspend or discontinue any part of the Service at any time, and we may set or change rate limits.

2.2 Accounts

You may sign in with GitHub, a wallet or a passkey. You are responsible for anything done through your account and for keeping your GitHub account, wallet and devices secure. We may suspend or close an account that breaks these terms.

2.3 Using images from the Service

Images in the free collection may be used freely in code reviews, chats, documents and similar contexts, including commercial ones. You may not claim the images as your own work, sell them as a collection, or use them to harass, deceive or break the law. The copyright in each image stays with the person who posted it (or its original author), so a rights holder may still object to a specific use, and you use images at your own risk.

2.4 Posting images

When you post an image you confirm that you own it or have the right to publish it under these terms, and that it does not infringe anyone's copyright, trademark, privacy or publicity rights. You grant LGTM.lol a worldwide, royalty-free, non-exclusive licence to store, resize, cache, display and distribute the image through the Service and to let users use it as described in 2.3. For images you post to the premium collection, you also grant us the right to sell access and to display your payout address in the catalogue.

Posting is public and, for the IPFS option, effectively permanent. Do not post anything you may later need to take back.

You may not post content that is sexual, violent, hateful, harassing, infringing, deceptive, malicious (such as images crafted to exploit viewers' software), or that contains personal information about others. All posts are reviewed by the operators, who may remove any image for any reason without notice.

There is no tolerance for objectionable content or abusive users. Any image reported to us is reviewed and, if it breaks these terms, removed within 24 hours of the report, and the person who posted it is barred from posting again. Repeat or serious offenders are barred on the first report.

2.4a Reporting and blocking

Every image can be reported from the apps (tap the image, then Report) or by email as described in section 3.4. A report hides the image on the reporting device at once and notifies the operators, who act on it within 24 hours. In the apps you can also block a poster, which immediately hides everything they posted from your feed and notifies the operators. Reports and blocks are recorded, and are not visible to other users or to the poster. Filing reports in bad faith, in bulk or by script is itself a breach of these terms.

2.5 Premium images and payments

Premium images are sold to automated clients over x402, priced per request in USDC on Base. Payment goes directly from the buyer's wallet to the submitter's wallet, we do not hold funds. Each successful payment buys one delivery of one image through a URL that expires after a short time. Blockchain transactions cannot be reversed, so payments are non-refundable except where the law requires otherwise. You are responsible for any taxes and for complying with the laws that apply to your use of crypto-assets. Prices and availability may change at any time.

2.6 NFTs

The Service lets you record an NFT for an image you posted. The mint is performed by your wallet on a public blockchain and recorded by the Service. We do not issue, custody, price or guarantee NFTs, and a token represents no rights beyond those stated in the token metadata.

2.7 API, MCP, Skills, extension and apps

The API and MCP server are offered free, without a key and without an uptime guarantee. You may not circumvent rate limits, scrape the Service beyond the documented endpoints, or build a service that merely re-hosts the collection. The extension and apps are provided under the terms of the store that distributes them in addition to these terms, and the apps' use of your photo library is governed by section 1.

2.8 Prohibited conduct

Do not attempt to gain unauthorised access to the Service or its users' accounts, interfere with its operation, send spam, impersonate anyone, or use the Service for anything unlawful. Automated agents must respect the 402 payment flow and may not retry failed payments abusively.

2.9 Disclaimer of warranties

The Service is provided "as is" and "as available", without warranties of any kind, express or implied, including fitness for a particular purpose, non-infringement and uninterrupted or error-free operation. We do not guarantee the accuracy, legality or safety of images posted by users.

2.10 Limitation of liability

To the fullest extent permitted by law, LGTM.lol and its operators are not liable for any indirect, incidental, special, consequential or punitive damages, or for lost profits, data or goodwill, arising from your use of the Service. Our total liability for any claim is limited to the greater of the amount you paid us in the preceding twelve months and 10,000 Japanese yen. Nothing in these terms limits liability that cannot be limited under applicable law, including under consumer protection law in your country of residence.

2.11 Indemnity

You will defend and indemnify LGTM.lol and its operators against claims arising from content you post or from your breach of these terms.

2.12 Governing law and disputes

These terms are governed by the laws of Japan, without regard to conflict-of-law rules. Disputes are subject to the exclusive jurisdiction of the Tokyo District Court as the court of first instance. If you are a consumer in the EU, UK or another jurisdiction that grants you mandatory protections or the right to sue at home, those rights are unaffected.

2.13 Changes

We may update these terms and this policy. The current version is always at lgtm.lol/legal with the date of the last change. For material changes we will post a notice on the site. Continued use after a change means you accept it.

3. Copyright

We respect the rights of creators and respond to notices of infringement under the US Digital Millennium Copyright Act (DMCA), the Japanese Provider Liability Limitation Act, and equivalent laws elsewhere.

3.1 Reporting an infringing image

Email [email protected] with the subject "Copyright notice" and include:

The URL of each image on LGTM.lol you are reporting (the lgtm.lol/i/… page or the image URL).
Identification of the original work and proof that you own it or act for the owner.
Your name, address and email, and a statement that you have a good-faith belief the use is not authorised by the rights holder, its agent or the law.
A statement, under penalty of perjury, that the notice is accurate and that you are the rights holder or authorised to act on their behalf.
Your physical or electronic signature.

We remove or disable access to the image promptly after receiving a complete notice, and we notify the poster where we can. Copies on IPFS or public blockchains that we do not control are outside this process.

3.2 Counter-notice

If your image was removed and you believe this was a mistake, send a counter-notice to the same address with the removed URL, your contact details, a statement under penalty of perjury that you have a good-faith belief the removal was in error, and your consent to the jurisdiction of the Tokyo District Court (or, for US residents, the federal court for your district). We may restore the image after 10 to 14 business days unless the claimant tells us they have filed a court action.

3.3 Repeat infringers

Accounts that repeatedly post infringing content are closed.

3.4 Other reports

To report an image that is unlawful or violates section 2.4 for a reason other than copyright, use the Report action in the apps, or the same address with the subject "Report". We act on such reports within 24 hours as described in section 2.4.

4. Contact

Operator	LGTM.lol
Email	[email protected]
Privacy and data requests	Same address, subject "Privacy request"
Copyright notices	Same address, subject "Copyright notice"
Direct links	lgtm.lol/privacy · lgtm.lol/terms

If any part of this document is held unenforceable, the rest remains in effect. This document is the entire agreement between you and LGTM.lol about the Service and replaces the version in effect since 2016.