The short version
- You control your site’s data. We process it only to run CodeGecko for you.
- The collector is designed to send no personal data, so there’s very little to protect, and we protect it anyway.
- We list every subprocessor and tell you before we add one.
- We tell you about a breach within 72 hours of confirming it.
Scope and roles
This agreement applies when CodeGecko legal entity processes personal data on your behalf under our terms of service. You are the controller (or “business”, under the CCPA); we are the processor (“service provider”). If this agreement and the terms conflict on data protection, this agreement wins.
Details of processing
| Subject matter | Measuring how releases of your website perform for real visitors |
|---|---|
| Duration | While you use CodeGecko, plus the deletion period below |
| Data subjects | Visitors to your site; your team members; commit authors in git history you send |
| Data | Measurement data designed to carry no personal data; technical request data (IP address, user agent) in transit; commit author names; account details |
| Special categories | None. Don’t send any. |
| Purpose | Collecting, storing and comparing measurements, and showing reports |
| Retention | Until you delete the project or account; once paid plans start, your plan’s history window |
Our obligations
- Process personal data only on your documented instructions: these terms and how you configure CodeGecko.
- Never sell or share it, or use it for any purpose outside the service, including advertising.
- Make sure everyone with access is bound by confidentiality.
- Help you answer data subject requests and carry out impact assessments where needed.
- Tell you if we think an instruction breaks data protection law.
Security measures
- Minimization: query strings, fragments, IDs, emails and tokens are stripped in the browser; paths become templates.
- Encryption: TLS for all data in transit; encryption at rest by Supabase.
- Credentials: keys stored as SHA-256 hashes and shown once; public keys accepted only from the registered origin.
- Isolation: row-level security separates every project in the database.
- Abuse: per-project rate limits per minute and per month.
- Access: production access limited to named staff, with MFA required.
Subprocessors
You authorize us to use these subprocessors. We’ll give at least 30 days notice of a new one on this page and by email, and you can object. If we can’t resolve the objection, you can end the service.
| Subprocessor | Purpose | Location |
|---|---|---|
| Vercel Inc. | Hosting, website and APIs | Region |
| Supabase, Inc. | Database, authentication and sign-in emails | Region |
| Email provider | Service email, once we send it | Region |
| Payment processor | Billing, once paid plans open | Region |
Data subject requests
If someone asks us directly about data we process for you, we’ll pass the request to you and not answer it ourselves unless you ask us to. Because collector data identifies no one, most visitor requests will have nothing to match.
Personal data breaches
We’ll notify you without undue delay, and within 72 hours of confirming a breach that affects your data, with what we know, what we’re doing, and who to contact. We’ll update you as we learn more.
Deletion and return
You can delete a project at any time, and ask us for a copy of your data. When you delete a project or your account, or the service ends, we delete the personal data within 30 days, including from backups within backup window, unless the law requires us to keep it.
Audits
On request, we’ll give you the information you reasonably need to show compliance with this agreement. If that isn’t enough, you can audit us once a year with 30 days notice, at your cost, under confidentiality.
International transfers
Data may be processed in the United States. For data from the EU, EEA, UK or Switzerland, transfers are covered by the Standard Contractual Clauses module 2 and 3, which are incorporated by reference. Confirm with counsel.
Contact and signing
Need a signed copy for your records? Write to privacy@your-domain and we’ll send one countersigned by CodeGecko legal entity.
