Privacy Policy

The short version

syncup turns your git history into standups and summaries. We read your commit activity to do that, we encrypt the credentials we hold, and we never store your source code. This policy explains exactly what we collect and why.

What we collect

• Account details — your email, optional name, and (for OAuth sign-ins) your provider profile and avatar.
• Provider connections — read-only access tokens for GitHub, GitLab, or Bitbucket, stored encrypted (AES-256-GCM).
• Commit metadata — messages, hashes, branches, timestamps, and per-file change stats (paths and added/removed line counts), cached to generate your scripts.
• Generated scripts — the standups and summaries we produce for you.
• Usage records — counts and timing of generations, used for plan limits and billing.
• Limited technical data — your IP address at sign-up, used only to prevent abuse and fraudulent account creation.

What we do NOT store

We do not store your source code. For deep (Pro-quality) context we read commit diffs at generation time, use them in-memory to write your script, and discard them immediately — they are never written to our database.

How your data is used

• To generate your standups and summaries.
• To operate your account, enforce plan limits, and process billing.
• To send transactional email (verification codes, password resets).
• To prevent abuse and keep the service secure.

AI processing

To write your script we send the relevant commit data — including diffs for deep context — to our AI provider, OpenRouter, which routes the request to Anthropic. They process it to generate your summary. We don't store the diffs after generation, and we don't use your data to train models. Their handling of the request is governed by their own data policies.

Service providers (subprocessors)

• Neon — managed PostgreSQL database.
• Railway — backend application hosting.
• Vercel — frontend hosting.
• Lemon Squeezy — payments and Merchant of Record (handles card data; we never see it).
• OpenRouter & Anthropic — AI script generation.
• Resend / SMTP — transactional email delivery.
• Sentry — error monitoring.

Data retention & deletion

You can delete your account at any time from Settings. Deletion is permanent and cascades — your connections, repos, cached commit metadata, scripts, and usage records are removed. Encrypted provider tokens are deleted when you disconnect a provider or delete your account.

Security

We use read-only OAuth scopes, encrypt provider tokens at rest with AES-256-GCM, and serve everything over HTTPS. Sessions use signed, httpOnly cookies. See our Security page for more.

Cookies

We use a single httpOnly session cookie to keep you signed in. We don't use advertising or third-party tracking cookies.

Contact

Questions about your data or this policy? Reach us at support [at] getsyncup.io.