Privacy Policy

#1. Information We Collect

1.1 Information from GitHub OAuth

When you sign in using GitHub OAuth, we request certain permissions and receive data directly from GitHub's API. The specific data we collect includes:

• →Identity Data: GitHub user ID, username (login), display name, and profile avatar URL.
• →Contact Data: Primary email address associated with your GitHub account (if public or if the user:email scope is granted).
• →Profile Data: Public biography, location, company, website URL, account creation date, and public repository count.
• →Social Graph Data: GitHub follower count and following count (counts only, not individual lists).
• →Repository Data: Names, descriptions, primary programming languages, topic tags, star counts, fork counts, and last push dates of your public repositories (up to 300, excluding forks).
• →Contribution Data: Aggregate commit contribution counts over the trailing 12 months and weekly contribution calendar data (heatmap), obtained via GitHub's GraphQL API.
• →Pinned Repository Data: Up to 6 repositories you have pinned on your GitHub profile.
• →Organization Data: Public GitHub organizations you are a member of (names only).
• →OAuth Access Token: A GitHub OAuth access token used solely to retrieve the above data. This token is stored encrypted and is never exposed to other users or used for any purpose other than syncing your GitHub data on your behalf.

1.2 Information You Provide Directly

• →Bio / README: Free-text biography you write during onboarding or when editing your profile. Supports Markdown formatting.
• →License Preference: Your selected relationship preference expressed as a software license type (MIT, Apache-2.0, GPL, CC, or Proprietary).
• →Open Issues / Dealbreakers: Optional tag-style labels describing preferences or dealbreakers you choose to disclose.
• →Social Contact Links: Optional links to Instagram, LinkedIn, Twitter/X, Discord, personal website, and contact email. Your public website may appear on your profile. Other contact details are only shared with another user after a mutual Merge Request is accepted by both parties.
• →Profile Status: Onboarded GitDate profiles remain active so they stay visible for discovery and matching unless an account is suspended.

1.3 Information Collected Automatically

• →Log Data: When you interact with the Platform, our servers automatically record information including your IP address, browser type and version, operating system, referring URL, pages visited, timestamps, and HTTP status codes.
• →Device Data: Device type, screen resolution, and language settings.
• →Usage Data: Features you interact with, profile pages you view, activity feed interactions, and navigation patterns.
• →Session Data: Encrypted session tokens stored in HTTP-only cookies, used solely for authentication.

1.4 Information from Other Users

• →Profile Views: We record when other authenticated users view your profile, including a timestamp. We store only the viewer's user ID — not their identity to third parties.
• →Stars and Follows: When another user stars or follows your profile, we record that interaction and the associated user IDs.
• →Merge Requests: When another user sends you a Merge Request (expression of interest), we record the sender's identity and timestamp.

#2. How We Use Your Information

We use the information we collect for the following purposes, each grounded in a lawful basis:

• →Providing the Platform: Creating and maintaining your profile, running the daily matching algorithm, displaying activity feeds, processing Merge Requests, and enabling stars and follows.
• →Matching Algorithm: We use your programming languages, repository topics, commit activity, account age, and license preference to compute compatibility scores with other users. This processing is entirely deterministic and rule-based — no machine learning or AI is used.
• →GitHub Data Synchronization: Using your stored OAuth access token to periodically refresh your GitHub profile data (at most once every six hours at your request, or automatically approximately once every 24 hours).
• →Notifications: Sending in-app, email (if configured), and browser push notifications about matches, stars, follows, Merge Requests, and platform activity.
• →Safety and Security: Detecting abuse, fraudulent accounts, spam, and policy violations; enforcing our Terms of Service.
• →Analytics and Improvement: Understanding how the Platform is used to improve features, performance, and user experience. We use aggregated, de-identified data where possible.
• →Legal Compliance: Complying with applicable laws, regulations, court orders, and governmental requests.
• →Communications: Sending transactional emails (account creation, password resets if applicable, match notifications) and, with your explicit consent, product updates and announcements. You may opt out of non-transactional communications at any time.

#3. How We Share Your Information

3.1 With Other Platform Users

• →Public Profile: Your username, display name, avatar, bio, GitHub statistics, programming languages, pinned repositories, open issues, license, and profile status are visible to all authenticated Platform users.
• →Activity Feed: Certain actions (profile created, star given/received, profile viewed, match created, Merge Request sent/accepted) appear in the public activity feed visible to all authenticated users. Merge Request acceptance or rejection details are genericized and do not reveal the responding party's identity to the general feed.
• →Social Links (Gated Disclosure): Your optional social contact links are only disclosed to a specific user after a bilateral Merge Request is accepted by both parties. At no other time are these links shared.
• →Email Address: Your email address is never shown to other users.

3.2 With Service Providers (Data Processors)

We share personal information with the following categories of vendors who process data on our behalf under data processing agreements:

• →Cloud Hosting — Vercel, Inc.: Hosts the Platform application servers in the United States. May receive request metadata and log data.
• →Database — MongoDB, Inc. (Atlas): Stores all user data in an encrypted MongoDB cluster in the United States (AWS us-east-1 region or equivalent).
• →Email Delivery — Resend, Inc.: Used to deliver transactional and notification emails on our behalf. Receives your email address and email content.
• →GitHub, Inc. (Microsoft Corporation): Our OAuth identity provider. We receive data from GitHub as described in Section 1.1. GitHub's privacy practices are governed by the GitHub General Privacy Statement.

3.3 Legal and Safety Disclosures

We may disclose personal information if we believe in good faith that disclosure is necessary to: (a) comply with applicable law, regulation, legal process, or governmental request; (b) enforce our Terms of Service or other agreements; (c) detect, prevent, or address fraud, security, or technical issues; or (d) protect the rights, property, or safety of GitDate, our users, or the public.

3.4 Business Transfers

If GitDate is involved in a merger, acquisition, asset sale, financing, reorganization, bankruptcy, or other corporate transaction, your personal information may be transferred as part of that transaction. We will provide notice (via email or prominent notice on the Platform) before your personal information becomes subject to a materially different privacy policy.

3.5 With Your Consent

We may share your information for any other purpose with your explicit prior consent.

#4. Data Retention

• →Active Accounts: We retain your personal information for as long as your account is active or as needed to provide the Platform.
• →After Account Deletion: Upon verified account deletion request, we will delete or anonymize your personal profile data within 30 days, except as set out below.
• →Activity Events: Activity events in the public feed are automatically deleted after 90 days via a TTL database index.
• →Legal Hold: Notwithstanding the above, we may retain certain data for longer periods as required by law, to resolve disputes, prevent fraud, enforce agreements, or for legitimate business purposes. In such cases, we will retain only the minimum data necessary and isolate it from active processing.
• →Backup Systems: Data may persist in backup systems for up to 90 days after deletion from primary systems. Backups are encrypted and access-controlled.
• →Log Data: Server and access logs are retained for 90 days for security and operational purposes.
• →GitHub OAuth Token: Your GitHub access token is deleted immediately upon account deletion or revocation of the GitDate OAuth application in your GitHub settings.

#5. Data Security

We implement and maintain commercially reasonable technical, administrative, and organizational security measures designed to protect your personal information from unauthorized access, disclosure, alteration, and destruction. These measures include:

• →Encryption of data in transit using TLS 1.2 or higher (HTTPS enforced on all routes).
• →Encryption of data at rest within our database provider.
• →Encrypted storage of GitHub OAuth access tokens.
• →HTTP-only, Secure-flag session cookies to prevent client-side token theft.
• →Access controls limiting employee access to personal data on a need-to-know basis.
• →Regular security review of application dependencies.

#6. Your Privacy Rights

Depending on your jurisdiction, you may have the following rights regarding your personal information:

• →Right of Access: Request a copy of the personal information we hold about you.
• →Right of Correction: Request correction of inaccurate or incomplete personal information. Note that most profile data is synced from GitHub; to change it, update your GitHub profile and trigger a sync.
• →Right of Deletion: Request deletion of your account and personal information, subject to legal retention requirements described in Section 4.
• →Right to Withdraw Consent: Where we process your data based on consent, you may withdraw consent at any time without affecting the lawfulness of prior processing.
• →Right to Object: Object to processing of your personal information for direct marketing purposes.
• →Right to Portability: Receive a machine-readable copy of personal information you have provided to us.
• →Right to Opt Out of Sale / Sharing: We do not sell or share personal information for cross-context behavioral advertising. This right is therefore satisfied by default.

To exercise any of these rights, email us at info@gitdate.ink with the subject line "Privacy Rights Request" and verification of your identity. We will respond within 30 days (or 45 days where permitted by law with notice).

#7. California Privacy Rights (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively "CCPA/CPRA"), grants you additional rights.

7.1 Categories of Personal Information Collected

We collect the following CCPA categories: Identifiers (name, username, email, IP address); Internet or Electronic Activity (usage data, log data); Professional or Employment-Related Information (GitHub profile data, organization memberships); Inferences drawn from personal information (compatibility scores).

7.2 Your California Rights

• →Right to Know: Request disclosure of categories of personal information collected, purposes of collection, categories of third parties with whom we share it, and specific pieces of personal information collected about you.
• →Right to Delete: Request deletion of personal information we have collected, subject to certain exceptions.
• →Right to Correct: Request correction of inaccurate personal information.
• →Right to Opt Out of Sale or Sharing: We do not sell personal information and do not share it for cross-context behavioral advertising. No opt-out action is required.
• →Right to Limit Use of Sensitive Personal Information: We do not use or disclose sensitive personal information for any purpose other than providing the Platform.
• →Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA/CPRA rights.

To submit a verifiable consumer request, email info@gitdate.ink. You may also designate an authorized agent to make a request on your behalf, subject to verification. We will respond within 45 days (extendable by an additional 45 days with notice).

Shine the Light (California Civil Code § 1798.83): California residents may request information about personal information disclosed to third parties for their direct marketing purposes during the preceding calendar year. We do not disclose personal information to third parties for their direct marketing purposes.

#8. EEA, UK & Switzerland (GDPR)

If you are located in the European Economic Area, United Kingdom, or Switzerland, the following additional terms apply to our processing of your personal information under the General Data Protection Regulation ("GDPR") or applicable national implementation.

8.1 Data Controller

GitDate, Inc., reachable at info@gitdate.ink, is the data controller for personal information processed through the Platform.

8.2 Legal Bases for Processing

• →Contract Performance (Art. 6(1)(b)): Processing necessary to provide the Platform services you have registered for.
• →Legitimate Interests (Art. 6(1)(f)): Security monitoring, fraud prevention, Platform improvement, and direct communications about the Platform (balanced against your interests).
• →Legal Obligation (Art. 6(1)(c)): Processing required to comply with applicable law.
• →Consent (Art. 6(1)(a)): Marketing communications and push notifications (where you have opted in).

8.3 International Data Transfers

Your personal information is processed and stored in the United States. When we transfer personal information from the EEA, UK, or Switzerland to the United States, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, or other appropriate transfer mechanisms. By using the Platform, you acknowledge that your information will be transferred to and processed in the United States.

8.4 Supervisory Authority

You have the right to lodge a complaint with your local data protection supervisory authority. A list of EEA supervisory authorities is available at edpb.europa.eu.

#9. Cookies & Tracking Technologies

We use a limited set of cookies and similar technologies:

• →Strictly Necessary Cookies: An HTTP-only, Secure, SameSite=Lax session cookie used to maintain your authenticated session. This cookie is essential for the Platform to function and cannot be disabled.
• →CSRF Protection: A token cookie used to prevent cross-site request forgery attacks.

We do not use advertising cookies, tracking pixels, or third-party analytics scripts. We do not use fingerprinting or other persistent tracking mechanisms. You may configure your browser to block cookies; however, this will prevent you from signing in to the Platform.

#10. Third-Party Services & Links

The Platform may contain links to third-party websites, repositories, or services (including GitHub.com). This Privacy Policy does not apply to those third parties. We are not responsible for the privacy practices of third-party services. We encourage you to review the privacy policies of any third-party services you access.

Our Platform integrates with GitHub's API. Your use of GitHub is governed by GitHub's Privacy Statement and Terms of Service. You can revoke our access to your GitHub account at any time from your GitHub account settings under Authorized OAuth Apps.

#11. Children's Privacy

The Platform is not directed to, and we do not knowingly collect personal information from, children under the age of 13 (or the applicable age of digital consent in your jurisdiction). If you are under 13 years of age, you are not permitted to use the Platform. If we become aware that we have collected personal information from a child under 13 without verified parental consent, we will delete that information promptly.

If you are between the ages of 13 and 18, you must have the permission of a parent or legal guardian to use the Platform and to agree to this Privacy Policy and our Terms of Service on your behalf. We recommend that parents and guardians review and supervise their children's use of online services.

#12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by: (a) updating the "Last Updated" date at the top of this page; (b) sending an email to the address associated with your account; and/or (c) displaying a prominent notice within the Platform. Your continued use of the Platform after the effective date of the revised policy constitutes your acceptance of the changes. If you do not agree to the revised policy, you must stop using the Platform and delete your account.

We encourage you to review this Privacy Policy periodically to stay informed about our data practices.

#13. Contact & Data Requests

For privacy-related questions, requests, or concerns, please contact our Privacy Team:

We will make reasonable efforts to respond to all legitimate requests within 30 days. Occasionally it may take us longer if your request is particularly complex or you have made multiple requests. In that case, we will notify you within 30 days and keep you updated.