Privacy Policy

1. Information We Collect

We collect information you provide directly to us, such as your email address and GitHub profile information when you authenticate via Supabase Auth. We also collect metadata about repositories you choose to back up and operational logs required to process backup, replication, and restore jobs.

When you use the contact form, we collect your email address and message to respond to your inquiry.

When affiliate attribution is enabled and you arrive through a partner link, we collect the click identifier in that link. A cookie containing the click identifier and its capture time keeps the referral available for up to 30 days. At registration, we save the referral and its capture time with the registration event and remove the cookie. We use that saved referral to report a first subscription purchase confirmed in our payment database and subsequent renewals.

2. How We Use Information

We use the information to provide, maintain, and improve RepoVault services; to authenticate users; to schedule and execute backups; to replicate snapshots to secondary storage; and to communicate with you about service-related issues.

3. Data Storage and Security

Snapshot artifacts are stored in encrypted object storage (primary and secondary). Database records are protected by standard access controls and encrypted at rest where supported by the infrastructure provider. We do not persist GitHub installation tokens.

Before registration, referral clicks are stored only in the browser cookie, which expires after 30 days. Registration events retain the referral identifier and original click time so a qualifying purchase can be reported without another browser visit. We do not keep a separate click history or attribution table. Conversion records remain until account deletion so purchase reporting, renewals, and delivery retries can be processed consistently.

4. Third-Party Services

We use Supabase for authentication and primary storage, and DigitalOcean Spaces (or another S3-compatible provider) for secondary replication. These services have their own privacy policies and security practices.

Contact messages are delivered through a shared contact service hosted on DigitalOcean Functions using Resend for email delivery.

When affiliate attribution is enabled, we send the referring affiliate network the click identifier, event type, and a unique conversion identifier. These reports do not include your email address, GitHub identity, repository contents, or browser authentication credentials.

5. Your Rights

You may request deletion of your account and associated data by contacting us. Upon deletion, we remove database records and schedule storage artifacts for removal in accordance with our retention policy.

6. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the new policy on this page with an updated effective date.

7. Contact

If you have questions about this Privacy Policy, please contact us.