Privacy Policy

Last Updated: March 10, 2026

GitLookout ("we," "us," or "our") is committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy describes how we collect, use, store, and protect your data when you use our service.

This policy is designed to comply with applicable data protection laws, including the General Data Protection Regulation (GDPR) of the European Union, the California Consumer Privacy Act (CCPA), the California Privacy Rights Act (CPRA), the Personal Information Protection and Electronic Documents Act (PIPEDA) of Canada, and other applicable privacy regulations.

1. What Data We Collect

We collect only the minimum data necessary to provide our service. Here is a complete and transparent list of all data we store:

1.1 Account Information

When you create an account, we collect:

• Email address, used for authentication, account recovery, and essential service communications. —
• Display name, used to personalize your experience within the application. —
• Avatar URL, a link to your profile picture as provided by your authentication provider (GitHub or Google). —

1.2 Authentication Credentials

• GitHub or Google OAuth tokens, used to authenticate API requests on your behalf. These tokens are encrypted at rest using industry-standard cryptographic methods (libsodium/pgsodium) and are never stored in plaintext.
• GitHub Personal Access Tokens (PATs), if you choose to link a PAT, it is encrypted at rest using the same encryption infrastructure. We never log or display your tokens.
• Organization Discovery OAuth, when you use the 'Join with GitHub' feature to discover existing installations in your organizations, we perform a one-time GitHub OAuth authorization with read:org scope. This token is used solely to query your organization memberships and is immediately discarded after the discovery process. It is never stored, logged, or used for any other purpose.

1.3 User-Generated Content

• Notes and Task Lists, any text you write in Notes or Task List widgets is encrypted at rest before being stored in our database. Even our own database administrators cannot read your content.
• Dashboard configurations, widget types, layout positions, and display preferences.
• Alert configurations, notification rules you define for your repositories.

1.4 AI Features (Optional)

If you choose to use our AI-powered insights:

• Your AI API key, if you bring your own key (BYOK), it is encrypted at rest. We never use your key for any purpose other than generating insights on your behalf.
• AI-generated responses, cached insights are encrypted at rest and automatically pruned (only the last 3 are retained).
• Token usage metadata, we record aggregate token counts per request for usage tracking. This metadata does not contain any of your repository data or content.

1.5 Technical Data

• Session identifiers, randomly generated UUIDs used to maintain your login session. Sessions expire automatically after 7 days.
• Web Push subscription endpoints, if you enable browser notifications, we store the technical endpoint required to deliver push notifications.
• IP addresses, recorded in audit logs when your credentials are accessed (encrypted or decrypted). IP addresses are used exclusively for security monitoring and are automatically deleted after 90 days. We do not use IP addresses for tracking, profiling, or geolocation.

1.6 Chrome Extension

If you use the GitLookout Chrome Extension:

• The extension authenticates using your existing GitLookout session cookie, no additional credentials are collected or stored.
• Widget selection and preferences are stored exclusively in your browser's local storage. This data never leaves your device and is not transmitted to our servers.
• The extension does not collect any analytics, telemetry, browsing history, or personal data beyond what is already described in this policy for the main application.

2. What Data We Do NOT Collect or Store

This is equally important. GitLookout does not store:

• ❌ Your source code, we never download, cache, or store any code from your repositories (public or private).
• ❌ Repository contents, file trees, commit diffs, README contents, or any other file data are fetched in real-time from the GitHub API and are never persisted in our database.
• ❌ Issue or pull request bodies, detailed descriptions, comments, and review threads are fetched on-demand and never stored.
• ❌ Commit messages or history, these are retrieved live from GitHub and are not retained.
• ❌ Advertising or behavioral profiling data, we do not use advertising pixels, retargeting tools, or behavioral tracking for marketing purposes. We use PostHog, a privacy-focused analytics platform, to collect anonymized usage data (page views, feature usage, device type) to improve the product. No personal data or repository content is shared with PostHog.
• ❌ Data from repositories you do not own, we only access repositories you have explicitly authorized through your GitHub account or GitHub App installation.

3. How We Use Your Data

We use your personal information solely for the following purposes:

We never sell, rent, share, or trade your personal data with third parties for marketing or advertising purposes.

4. How We Protect Your Data

4.1 Encryption at Rest

All sensitive data is encrypted using pgsodium (libsodium for PostgreSQL), a proven, audited cryptographic library:

• ✅ GitHub OAuth tokens and Personal Access Tokens
• ✅ Sentry API tokens and refresh tokens
• ✅ AI provider API keys
• ✅ AI-generated insight responses
• ✅ Notes and Task List content
• ✅ Session access tokens

Encryption keys are derived per-user, meaning each user's data is encrypted with a unique key. Even in the unlikely event of a database breach, encrypted data cannot be decrypted without the corresponding key material.

4.2 Encryption in Transit

All data transmitted between your browser and our servers is encrypted using TLS (HTTPS). We enforce HTTPS in production and use secure, HTTP-only cookies with the SameSite attribute to prevent cross-site request forgery.

4.3 Access Controls

• Row-Level Security (RLS) is enabled on every table in our database. This means each user can only access their own data at the database level, not just the application level. —
• Authentication is required for all API endpoints.
• Administrative access to the database is restricted and logged.

4.4 Secure Token Handling

• Tokens are encrypted before storage and decrypted only in server-side memory when needed for API calls.
• When you delete a GitHub account from our system, we cryptographically overwrite the token data before deleting the record, preventing any possibility of recovery.
• Legacy or deprecated token fields are proactively cleared.

4.5 Audit Logging

For security and compliance purposes, we maintain audit logs of token access events (encryption and decryption operations). These logs record the user ID, action type, timestamp, and the originating IP address. Audit logs are retained for 90 days and then automatically deleted. They are used exclusively for security monitoring, incident investigation, and compliance purposes, never for advertising, profiling, or any unrelated purpose.

5. Data Retention and Deletion

5.1 Retention Periods

5.2 Account Deletion

You can delete your account at any time from the application settings. When you delete your account:

• All of your data is permanently and irrevocably deleted, including: your user profile, all dashboard configurations, all widgets and their content, all linked GitHub and Sentry accounts, all encrypted tokens, all AI keys and insights, all alert configurations and notification subscriptions, all session data, and all usage logs.
• Deletion is enforced at the database level through cascading foreign key constraints, ensuring no orphaned data remains.
• Your identity is also removed from our authentication provider to prevent reuse of linked credentials.
• This action cannot be undone.

5.3 Data Export

You have the right to export your data at any time. Our export feature provides a comprehensive JSON download of all your data (excluding encrypted tokens for security reasons).

6. Third-Party Services

GitLookout integrates with the following third-party services. Your use of these services is governed by their respective privacy policies:

We do not use any advertising networks or data brokers. PostHog is the only analytics service we use.

7. Your Rights

Under GDPR (European Union / EEA)

• Right of Access, You can request a copy of all data we hold about you.
• Right to Rectification, You can update your profile information at any time.
• Right to Erasure ("Right to be Forgotten"), You can delete your account and all associated data.
• Right to Data Portability, You can export your data in a machine-readable format (JSON).
• Right to Restrict Processing, You can request that we limit how we use your data.
• Right to Object, You can object to processing based on legitimate interest.
• Right to Withdraw Consent, Where processing is based on consent, you can withdraw it at any time.

Under CCPA / CPRA (California, United States)

• Right to Know, You can request disclosure of the categories and specific pieces of personal information we collect.
• Right to Delete, You can request deletion of your personal information.
• Right to Opt-Out of Sale, We do not sell your personal information. There is nothing to opt out of.
• Right to Non-Discrimination, We will not discriminate against you for exercising your privacy rights.

Under PIPEDA (Canada)

• Right to Access, You can request access to your personal information.
• Right to Challenge Compliance, You can challenge our compliance with PIPEDA.
• Consent, We obtain meaningful consent for the collection, use, and disclosure of your personal information.

To exercise any of these rights, please contact us at the email address provided in the Contact section below.

8. Cookies and Local Storage

GitLookout uses a single, essential cookie:

We do not use any tracking cookies, advertising cookies, or third-party cookies. The GitLookout Chrome Extension uses local storage solely to save your widget preferences, this data never leaves your browser and is not used for tracking. We do not use session storage to track user behavior.

9. Children's Privacy

GitLookout is not intended for use by individuals under the age of 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will promptly delete such data.

10a. Data Breach Notification

In the event of a data breach affecting your personal information, we will notify affected users via email within 72 hours of becoming aware of the breach, in compliance with applicable data protection laws including GDPR Article 34. We will also notify the relevant supervisory authority as required by law.

10. International Data Transfers

Your data is processed and stored on servers located in the United States (US-East region). Our infrastructure providers include Supabase (database and authentication, US-East), Vercel (frontend hosting, US), and Lemon Squeezy (payment processing). If you are located outside the United States, by using the Service you consent to the transfer of your data to the US. When we transfer data outside of the European Economic Area (EEA), we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) as approved by the European Commission.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. We will notify you of any material changes by posting a notice within the application. Your continued use of the service after any changes constitutes acceptance of the updated policy.

12. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us at:

📧 [email protected]

We will respond to your inquiry within 30 days, or sooner as required by applicable law.

13. Summary