Privacy Policy

This Privacy Policy explains how Gitmayo (“Gitmayo,” “we,” “us”) collects, uses, and protects your information when you use our website and service at gitmayo.com (the “Service”). Gitmayo turns your GitHub activity into a plain-English weekly summary. Privacy is central to how it is built: we read activity metadata, never the contents of your source code.

By using the Service, you agree to the collection and use of information as described here.

Information we collect

• Account information from GitHub sign-in: your GitHub username, user ID, email address, and avatar. Gitmayo uses GitHub as its only sign-in method.
• Connected accounts: if you link more than one GitHub account, we store the same account information for each connected account so each can receive its own summary.
• GitHub activity metadata for the repositories you select: commit messages, pull-request and issue titles, branch and repository names, and timestamps.
• GitHub access tokens, stored encrypted at rest and used only on our servers to fetch the activity above. Tokens are never sent to your browser.
• Your preferences: digest day and time, tone, timezone, plan, and email settings.
• Basic usage and diagnostic data: aggregate, privacy-friendly analytics about how pages perform (via Vercel Analytics and Speed Insights). We do not use this to build advertising profiles.

Information we do not collect

• The contents of your source code or files.
• Diffs or code changes — we read titles, messages, and timestamps, not the code itself.
• Payment card details (there is no paid billing at this time).

How we use your information

• To authenticate you and operate your account.
• To fetch and categorise the activity needed to generate your weekly summary.
• To generate your summary and display it in the app.
• To email your summary to you when email delivery is enabled.
• To maintain the security, reliability, and performance of the Service.

We do not sell your personal data, and we do not use it for third-party advertising.

Legal bases for processing

Where the EU/UK GDPR applies, we process your information to perform our contract with you (providing the Service you signed up for), on the basis of your consent (for example, sending summary emails, which you can turn off), and for our legitimate interests in keeping the Service secure and working.

Service providers

We share the minimum necessary information with providers that help us run Gitmayo:

• Supabase — database and authentication.
• Anthropic — generates the summary from categorised metadata.
• Resend — delivers the weekly email.
• Vercel — hosting and analytics.
• GitHub — sign-in and the source of activity metadata.

These providers process data on our behalf under their own terms and security commitments, and only for the purposes described above.

International data transfers

Our providers may process data in countries other than yours, including the United States. Where required, such transfers rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

Data retention

We keep your account information, preferences, stored activity metadata, and summaries for as long as your account is active. When you delete your account, this data is permanently removed. We may retain limited records where required for legal or security reasons.

Security

GitHub access tokens are encrypted at rest and used only server-side. Every database table enforces row-level security, so you can only ever access your own data, and one user can never read another user's activity or summaries. No system is perfectly secure, but we design Gitmayo to minimise the data we hold and the ways it can be exposed.

Your rights

You can view your data in the app and delete your account — and all associated data — at any time from Settings. Depending on where you live, you may also have rights to access, correct, export, restrict, or object to the processing of your personal data under laws such as the GDPR or CCPA. To exercise any of these rights, contact us using the details below.

Cookies

We use a small number of strictly necessary cookies to keep you signed in and to operate the Service. We do not use advertising or cross-site tracking cookies.

Children's privacy

Gitmayo is not directed to children and is not intended for anyone under 16. We do not knowingly collect personal data from children.

Changes to this policy

We may update this policy from time to time. When we do, we will revise the “last updated” date above and, for material changes, take reasonable steps to notify you.

Contact

Questions about privacy or your data? Email privacy@gitmayo.com.