Privacy Policy

1. Who we are

Repopack is operated by [operator legal name, legal form and registered address] ("Repopack", "we", "us"). We are the controller of the personal information described in this policy, except where section 14 says otherwise.

For privacy questions and requests, contact us at [privacy contact email]. Data protection officer: [to be confirmed].

2. What this policy covers

This policy covers repopack.com, the Repopack web application, the APIs, the rp command-line tool, Git and SSH access, and the jobs and applications you run on Repopack (together, the "Service"). Our Terms of Service govern your use of the Service. Acknowledging this policy is not consent to anything. It is how we tell you what we do.

This policy does not cover third-party services you use alongside Repopack, such as Git hosts, container registries or AI tools. It also does not cover applications that other people deploy on Repopack. Their operators are responsible for them.

3. Information we process

Account information

Your username, your email address, whether you've confirmed your email, when you signed up, and your notification settings. We record which version of the Terms of Service you accepted and which version of this policy you were shown, with timestamps. We don't ask for your real name, a profile photo, a phone number or payment details.

Sign-in and security information

• Sign-in codes: one-time codes we email you. They expire after 5 minutes.
• Browser sessions: a random session identifier kept in a cookie, and a matching record linking it to your account.
• CLI and API tokens: we store only a hash of each token, with its name, creation time and the time it was last used.
• CLI sign-in requests: hashed, short-lived codes used to connect the rp CLI to your account.
• SSH public keys you add, with the name you give them. If you don't give a key a name, we use the comment at the end of the key, which you can see in your account settings.
• Confirmations for sensitive actions, such as deleting a project: which action was requested, by whom and when, and whether it was confirmed.
• AI provider API keys, if you choose to save them in your account settings. Repopack does not currently use them to contact those providers.

Our application does not store IP addresses or browser and device details. Our network and server infrastructure necessarily receives your IP address when you connect, and system logs, such as those of our SSH server, may record it [retention of infrastructure logs to be confirmed].

Project and collaboration information

Projects you create or join, your role and permissions, and project invitations, including the email address a project owner invited, the role offered, who sent the invitation, and its status. We also record the tasks, notes, reviews and approvals you create, and a history of task events: who changed what, and when. Task activity is labelled as human or agent activity, as reported by the client that performed it. We also keep in-app notifications, for example when someone @mentions you.

Repository content and other content you provide

Git repositories, files, task text, pastes, and job and application configuration. This content is whatever you and your collaborators choose to put in it, and it may contain personal information about you or other people. For example, Git commits contain the author name and email address set in the committer's Git configuration. When Repopack itself creates a commit for you, such as a merge, it uses your username and the address <username>@users.repopack.com rather than your email address.

If you import a repository or GitHub issues, we copy that content into your project, including any names or usernames it contains, such as the GitHub usernames of issue authors.

Jobs, applications and runtime information

For jobs, we keep who started each run, the source commit, status, timestamps, the complete output log, errors and artifacts. For applications, we keep deployment records, Containerfiles, build output, environment variable names and values (values are encrypted), and any data your application writes to its volumes. We don't currently collect your applications' runtime logs or their visitors' requests. Requests to your application go to your application.

Technical information

We don't use analytics, tracking pixels or third-party scripts, and we don't load fonts or other resources from third parties. When something fails, our server error logs may record technical details, such as account or project identifiers. The rp CLI checks for updates by sending its version to our server, and we don't store these checks.

Communications

If you contact us, for example for support, to report a security issue or abuse, or to make a privacy request, we keep that correspondence to handle your request.

People who don't have an account

We process information about people without an account when a project owner invites them by email, when their names appear in content that users upload, and when they visit applications hosted on Repopack. People without an account can use the contact details in section 19 to exercise their rights.

4. Why we use it and our legal bases

Data protection law requires a legal basis for each use of personal information. We rely on the following:

Where we rely on legitimate interests, we have weighed them against your interests and rights, and you can object (see section 11). We don't currently rely on consent for any processing. If we ever need your consent, we will ask for it separately and specifically.

Improving the Service means things like fixing problems and understanding which features work. We don't use your private content to train machine learning models, we don't build advertising profiles, and we don't sell personal information.

5. Email and notifications

We send three kinds of email, and treat them differently.

Essential email

Sign-in codes, security and account notices, notice of important changes to our Terms or this policy, and other legal notices. We send these while you have an account, and you can't turn them off, because we need them to run and secure your account. Separately, when a project owner invites your email address to a project, we send the invitation on their behalf.

Workflow email

Workflow email tells you about activity on tasks you're involved in, which means tasks you created, own, commented on, reviewed, changed or were asked to review. It has three categories:

• Task activity: notes, status changes, assignments, review outcomes and merge conflicts;
• Review requests: when someone asks you to review a task; and
• Mentions: when someone @mentions you.

Workflow email is on by default because it is part of how collaboration on Repopack works. We send it only when activity involves you, and it never contains promotions. These emails include the project name, the task number and title, who acted, what changed, and up to 500 characters of the message. You can turn off all workflow email, or individual categories, at any time in Account settings → Notifications. Mentions still appear in the in-app notification bell. Desktop notifications stay off unless you turn them on.

Marketing email

We don't send marketing or promotional email, and we haven't asked for permission to. If that changes, we will ask for your separate, specific consent where the law requires it, and saying no won't affect your use of Repopack. Updating this policy will never count as that permission.

Our emails are plain text, without tracking pixels or tracked links.

6. Who can see your information

• Projects are private. Project content is visible only to people with access: project members, according to their roles. Project owners can also give limited permissions to all signed-in Repopack users. Signed-out visitors can't see projects.
• Your username appears on your activity in projects you take part in, for example your tasks, notes and reviews.
• Your email address is visible to the owners of projects you belong to or are invited to, in the project's member settings. Other members don't see it.
• What you publish is public. Anyone on the internet can access public pastes (shown with your username), job artifacts you make public, and applications you expose publicly. Artifacts produced by an application's builder unit can currently be downloaded by anyone who knows the project and application names.
• Repopack personnel with operational access to our infrastructure can technically access stored data. We access it only where needed to operate and troubleshoot the Service, to support you at your request, for security or abuse investigations, or to comply with the law.

7. Service providers and other recipients

We don't sell personal information, and we don't share it with anyone for advertising. Some providers necessarily process information on our behalf to run the Service:

• Hosting and infrastructure: [hosting provider(s), what they host, and where].
• Email delivery: our mail server at mail.repopack.com, which receives the recipient address and content of each email we send [confirm who operates it].
• Backups: [backup provider and location, if any].

Information also reaches other parties in these cases:

• Services you ask us to use. When you import a repository or GitHub issues, our servers request them from that host. When your builds pull container images, the registry receives our servers' requests. Your jobs and applications send data wherever your code sends it.
• Other users, as described in section 6.
• Authorities and others, where the law requires it or where it is needed to protect people, the Service or our rights (see section 17).

AI providers. Repopack's servers don't send your information to AI or machine learning providers. If you use AI agents with Repopack, you or your agent provider run them, and they access Repopack through the CLI or API with your credentials. What they send to their providers is governed by your arrangement with those providers.

8. Where your information is processed

[Where Repopack stores and processes information, and for any transfer outside the EU/EEA, the country and the safeguard relied on (for example an adequacy decision or standard contractual clauses).]

Services you choose to connect to, such as GitHub, and people you collaborate with may be located outside the EU/EEA.

9. How long we keep information

Where we must keep information for longer to comply with the law, or to establish, exercise or defend legal claims, we keep it for as long as that requires.

10. Deleting your account

You can't yet delete your account in the product. To delete it, contact us at [privacy contact email]. When we delete an account:

• we delete your account information, sign-in and security information, notification settings, notifications, pastes, and your saved SSH and AI provider keys;
• we delete projects where you are the only owner, including their repositories, jobs and applications, unless you first make someone else an owner; and
• your contributions to projects that others own stay in those projects. This includes commits, tasks, notes and reviews, which remain attributed to your username so the project's history still makes sense. If you have a particular reason why that attribution should be removed, tell us, and we will consider it.

Deleted information may remain in backups until they expire, as described in section 9.

11. Your rights

Depending on where you live, you have the right to:

• access your personal information and get a copy of it;
• correct inaccurate information;
• delete your information, subject to the limits in section 10 and the law;
• restrict how we use your information in certain circumstances;
• data portability: receive information you gave us in a reusable format. Your Git repositories can always be cloned;
• object to processing based on legitimate interests. For workflow email, the notification settings take effect immediately; and
• withdraw consent, if we ever rely on it, without affecting processing that has already happened.

Some things you can do yourself in the product: change notification settings, remove SSH and AI provider keys, delete pastes, and delete projects you own. For anything else, contact [privacy contact email]. We may need to confirm your identity, normally by email to your account address. We reply within one month, which the law lets us extend in complex cases, and we don't charge for requests unless they are manifestly unfounded or excessive. Not every request leads to the deletion of every record. If we can't fully meet a request, we will tell you why.

You can also complain to a data protection authority, in particular in the EU/EEA country where you live or work, or where you believe your rights were infringed. Our lead supervisory authority: [to be confirmed].

12. Cookies and local storage

We use no analytics, advertising or tracking cookies, so we don't show a cookie banner. If you turn on desktop notifications, your browser stores that permission. You can revoke it in your browser settings. If content you view on Repopack includes images hosted elsewhere, your browser loads them from those servers, which can see your IP address.

13. Security

We use technical and organisational measures appropriate to the Service, including:

• signing in with one-time email codes rather than passwords;
• storing CLI and API tokens, CLI sign-in codes and action confirmations only as hashes;
• encrypting application environment variable values at rest and never displaying them again after they are saved;
• restricting SSH access to Git operations for registered keys; and
• limiting access to projects according to project roles.

No service is perfectly secure, and we can't guarantee that information will never be accessed, lost or disclosed without authorisation. If a personal data breach is likely to put your rights at risk, we will notify the relevant authority and, where the law requires, you.

14. Your code, jobs and applications

You decide what personal information your repositories, jobs and applications contain and process. We don't know what that information is, and apart from operating and securing the Service, we don't use it for our own purposes. For that processing, we act on your behalf, and you are responsible for complying with data protection law, including informing the people concerned. We don't currently offer a data processing agreement. If you need one, contact us before using Repopack to process other people's personal information on your behalf.

15. Sensitive data and children

Repopack is not designed or certified for special categories of personal data, such as health, genetic or biometric data, or for data covered by specific regulatory regimes. Please don't use it for such data (see our Terms).

Repopack is not intended for anyone under 16. If we learn that a child under 16 has created an account, we will delete it.

16. Automated decisions

We don't make decisions about you based solely on automated processing that have legal or similarly significant effects. Automation in Repopack, such as task workflows, agents, jobs and checks, runs because you or your collaborators set it up.

17. Legal disclosures and business transfers

We may disclose information where the law requires it, for example in response to a valid order from a court or authority, or where it is necessary to protect the safety of people, the security of the Service, or our legal rights. We check that requests are lawful and disclose only what is required.

If Repopack is involved in a merger, acquisition, restructuring, financing, or a sale of all or part of its business, personal information may be transferred as part of that transaction, subject to applicable law and protections at least as strong as those in this policy. We will tell you before your information becomes subject to a different privacy policy.

18. Changes to this policy

We update this policy when the Service or our practices change. The date at the top of this page shows when the version you are reading takes effect, and earlier versions remain available. Before material changes take effect, we will publish the updated policy on this page and tell you by email. We won't treat an update to this policy as your consent to anything. If a new use of your information requires consent, we will ask for it separately.

19. Contact

[operator legal name and postal address]
Privacy requests: [privacy contact email]