Privacy Policy

1. Who is responsible

The controller for the processing described on this page, within the meaning of Article 4(7) GDPR, is githours.dev. Questions about this policy, and requests to exercise any of the rights in section 10, can be sent to [email protected].

No Data Protection Officer has been appointed. Where that changes, this section will name them.

2. What data GitHours processes

GitHours turns a repository’s commit history into a development-time report. The data it holds falls into four groups.

• Account data: your email address, an optional display name, a bcrypt hash of your password (never the password itself), your role, and timestamps for creation, update, email verification and — if you ask for deletion — deactivation.
• Project and repository data: project names and descriptions, calculation settings such as the gap threshold, and the repository URL or uploaded bundle you connect. A repository URL you supply may itself contain an access token; it is stored so analyses can be re-run, and is deliberately excluded from all application logs.
• Commit metadata and analysis results: commit timestamps, commit messages, and the author and committer names and email addresses recorded in the repository’s history, together with the calculated sessions and totals derived from them.
• Operational data: server logs containing request metadata and errors, and rate-limiting counters tied to your IP address and email address during sign-in.

3. Data about people who are not GitHours users

This deserves to be stated plainly rather than buried. A git history contains the name and email address of everyone who has committed to the repository. When you connect a repository, GitHours processes those identifiers for every contributor in the range you analyse, including people who have no account here and no relationship with the controller.

The legal basis for that processing is Article 6(1)(f) GDPR — the legitimate interest of a developer or agency in substantiating the hours they bill. GitHours acts on your instruction as to which repository is analysed, and you are responsible for having a lawful basis to submit a repository and its contributors’ data in the first place. It is not used to build contributor profiles across projects, is not enriched from any outside source, and is not disclosed to anyone other than the recipients of a report you choose to share.

4. What happens to your repository

To read a commit history, GitHours clones the repository into a temporary directory on its own server. That clone is a full working copy: the file contents of the cloned branch exist on the server for the duration of the analysis, not only the commit metadata the report is built from.

No file content is read into a report, a share link or an export — reports are derived from commit metadata only. But the clone itself is more than metadata while it exists, and this policy says so rather than implying the server only ever sees timestamps.

Temporary clone directories are removed after a successful analysis. Two concurrent analyses of the same repository each clone separately and the losing directory is orphaned until the server’s container is recycled, at which point its storage is reclaimed. Uploaded git bundles are deleted immediately once the repository has been connected.

5. Legal bases

Account data, project data and analysis results are processed to perform the contract you enter into by creating an account (Article 6(1)(b) GDPR). Verification and password-reset email is sent on the same basis.

Server logs, rate limiting and abuse prevention rest on legitimate interests in keeping the service available and secure (Article 6(1)(f) GDPR). Where any future feature relies on consent, it will ask for it separately and this section will say so.

6. Processors and sub-processors

GitHours does not sell data and does not share it for advertising. It is disclosed only to the providers needed to run the service, each under a data processing agreement:

• Resend — transactional email delivery (verification, password reset). Receives your email address and the contents of those messages.
• Hetzner Online GmbH (Hetzner Cloud) — application and database hosting on a single virtual server in the EU. Holds everything described in section 2. The PaaS layer and the PostgreSQL database both run self-hosted on that same server rather than as separate managed services, so no further third party receives this data.
• Cloudflare — DNS and edge delivery for githours.dev. Processes request metadata in transit.

7. No analytics, no advertising, no tracking

GitHours loads no analytics script, no advertising pixel and no third-party tracker. Its Content-Security-Policy restricts scripts, styles, fonts and network connections to its own origin, which is what makes that statement checkable rather than merely asserted — you can read the header yourself.

The only cookie set is the session cookie that keeps you signed in. There is no cookie banner because there is nothing to consent to beyond that strictly necessary cookie.

8. Share links

A share link publishes a read-only view of one analysis to anyone holding the link. Links carry an expiry date, 30 days by default, and can be revoked. They are excluded from search engines by both robots.txt and a noindex directive, but a link is a credential: anyone you send it to, or who it is forwarded to, can open the report until it expires.

9. How long data is kept

Account, project and analysis data is kept while your account exists. Requesting deletion deactivates the account and anonymises the email address so it no longer identifies you; related project and analysis records are removed with it.

Server logs are short-lived operational records and are not used to build any profile. Tokens and secrets are redacted before anything is written to a log.

Server logs are retained for 7 days and then discarded.

10. Your rights

Under the GDPR you have the right to access your data (Art. 15), to have inaccurate data corrected (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18), to data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). Where processing rests on consent, you may withdraw it at any time with effect for the future.

To exercise any of these, write to [email protected]. You also have the right to lodge a complaint with a data protection supervisory authority — in the EU, the authority for your country of residence, place of work, or the place where you believe the infringement occurred.

11. Security

Traffic is served over HTTPS with HSTS. Passwords are stored only as bcrypt hashes. Tokens, secrets, cookies and authorization headers are redacted from logs. Repository URLs are never logged, because a private-repository URL can embed credentials. Access to a project is scoped to the account that owns it on every read path.

No system is perfectly secure, and this section describes measures rather than guarantees.

12. Changes to this policy

Material changes will be reflected here with a new last-updated date. Continuing to use GitHours after a change indicates acceptance of the revised policy.