1. Introduction
Commit Tracker ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service at committracker.com.
We comply with the General Data Protection Regulation (GDPR) and other applicable data protection laws. By using our service, you agree to the collection and use of information in accordance with this policy.
2. Data Controller
Commit Tracker is the data controller responsible for your personal data. If you have any questions about this Privacy Policy, please contact us at privacy@committracker.com.
3. Information We Collect
3.1 Information You Provide
- Account Information: Email address, name (optional), and password when you create an account
- GitHub Account: If you sign in with GitHub, we receive your GitHub username, email, and profile picture
- Repository Subscriptions: The GitHub repositories you choose to track
- Payment Information: If you subscribe to a paid plan, payment is processed by Stripe. We do not store your credit card details.
3.2 Information Collected Automatically
- Usage Data: Pages visited, features used, and interactions with our service
- Device Information: Browser type, operating system, and device type
- Analytics: We use Vercel Analytics to collect anonymous usage statistics
4. Legal Basis for Processing (GDPR)
We process your personal data based on the following legal grounds:
- Contract: Processing necessary to provide our service to you
- Consent: Where you have given explicit consent (e.g., for analytics cookies)
- Legitimate Interests: To improve our service and ensure security
- Legal Obligation: To comply with applicable laws
5. How We Use Your Information
- To provide and maintain our service
- To authenticate your account and manage your subscriptions
- To send you updates about repositories you follow (via RSS feeds)
- To process payments and manage billing
- To improve and personalize our service
- To communicate with you about service updates
- To detect and prevent fraud or abuse
6. Cookies and Tracking
We use cookies and similar technologies for:
- Essential Cookies: Required for authentication and basic functionality
- Analytics Cookies: To understand how visitors use our service (Vercel Analytics)
6.1 Cookie Inventory
- authjs.session-token: Session authentication (essential, 7 days)
- authjs.csrf-token: CSRF protection (essential, session)
- authjs.callback-url: Redirect after login (essential, session)
- cookie-consent: Records your cookie preference (essential, persistent, localStorage)
- va: Vercel Analytics identifier (analytics, 1 year, only with consent)
You can manage your cookie preferences through the cookie consent banner, the "Cookie Preferences" link in the footer, or your browser settings. You may withdraw consent at any time.
7. Data Sharing and Third Parties
We may share your data with:
- Vercel: Hosting, serverless functions, and analytics (United States)
- Neon: PostgreSQL database hosting (United States)
- GitHub: OAuth authentication and repository data (United States)
- Stripe: Payment processing for paid plans (United States)
- Resend: Transactional email delivery — verification, password reset, and digest emails (United States)
We do not sell your personal data to third parties.
8. Data Retention
We retain your personal data for as long as your account is active or as needed to provide our services. If you delete your account, we will delete your personal data within 30 days, except where we are required to retain it for legal purposes.
9. Your Rights (GDPR)
Under GDPR, you have the following rights:
- Access: Request a copy of your personal data
- Rectification: Request correction of inaccurate data
- Erasure: Request deletion of your data ("right to be forgotten")
- Restriction: Request restriction of processing
- Portability: Request transfer of your data to another service
- Objection: Object to processing based on legitimate interests
- Withdraw Consent: Withdraw consent at any time where processing is based on consent
To exercise these rights, contact us at privacy@committracker.com.
10. International Data Transfers
Your data may be transferred to and processed in countries outside the European Economic Area (EEA). We ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the European Commission.
11. Children's Privacy
Our service is not intended for individuals under the age of 16. We do not knowingly collect personal data from children under 16. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at privacy@committracker.com and we will take steps to delete such information.
12. Security
We implement appropriate technical and organizational measures to protect your personal data, including encryption, secure authentication, and regular security assessments.
13. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last updated" date.
14. Contact Us
If you have any questions about this Privacy Policy or wish to exercise your rights, please contact us at privacy@committracker.com.
You also have the right to lodge a complaint with a supervisory authority if you believe your data protection rights have been violated.