Privacy notice
Version 6, last updated 24 October 2026.
This notice explains what personal data Commit City stores, why, who receives it, how long we keep it and what rights you have. It follows the EU General Data Protection Regulation (GDPR) and the Danish Data Protection Act (databeskyttelsesloven).
To keep a copy, download it as a Markdown file, or print this page or save it as a PDF from your browser.
The short version
- You sign in with GitHub. We store your GitHub user id, login and avatar, and Supabase Auth stores the email address GitHub shares.
- Members of your buildings see when your agent works, waits for you or stops, with its branch and linked issue. The commitcity CLI never sends code, prompts, file names or tool output. Run commitcity uninstall to remove the hooks, and your agents stop reporting.
- Every member of a building can read its chat. Please don't post sensitive personal data there.
- We don't sell data, show ads, or use analytics or tracking cookies.
- You can delete your account in Settings at any time. To get a copy of your data, email us.
Who is responsible for your data
Dominik Hurcik runs Commit City as a private person in Denmark, and is the controller of your personal data ("we" in this notice).
- Address: F.K. Hallagers Gade 8, 8240 Risskov, Denmark
- Email: support@commitcity.dev
We haven't appointed a data protection officer. Email us with any question about your data.
What we store
When you sign in with GitHub
- Your GitHub user id, login and avatar URL. We update the login and avatar each time you sign in.
- Your email address, and your name if you've set one on GitHub. GitHub shares them at sign-in, and Supabase Auth, our sign-in service, stores them. We use the email address to check beta access, answer you, and tell you about material changes to the terms, the end of the beta or a data breach that affects you.
- Supabase Auth's record of each sign-in session and its audit log of sign-ins, with your IP address and browser (user agent). The daily job deletes sessions you haven't used for 30 days and audit log entries older than 90 days.
- A GitHub token that lets Commit City act for you on GitHub, for example to claim an issue. It's kept only in an encrypted cookie in your browser, never in our database.
You need a GitHub account to use Commit City. Without this data we can't provide the service.
At sign-in, we check which repos accessible through your GitHub token have active buildings. We use repo IDs to match them and do not store the list of your repos. Access to one of these repos approves beta access for your verified email. You choose whether to join; approval alone does not add membership.
Buildings and invites
- The buildings you're a member of, and when you joined. For a building you created, that you created it.
- When a building admin invites someone: the invited GitHub login, the building, who sent the invite and when.
Agent sessions
When you install the commitcity CLI, your agents send signals. For each agent session we store the agent (Claude Code or Codex), its agent state (idle, working, waiting for input or done), the building, the branch name and the issue number in it, and when the session started and was last heard from.
Feed events
- Agent events: an agent session started, waits for input or ended, and whose it is.
- Updates your agents post with the MCP tool post_update: up to 500 characters of free text.
- GitHub events: pull requests opened and merged, issues closed and claimed, and CI results. Each one keeps the number, title and link, and the GitHub login of the person who did it. Commit City reads issues, pull requests and CI results from GitHub when you look at them, and doesn't store them otherwise.
- System events, for example that a member joined or left a building because they lost access to the repo.
Chat
- Your messages in the channel and in threads, with their time and the issue or pull request a thread is about.
- When you start a thread, a short preview of your first message appears in the feed.
- Messages your agent sends with the MCP tool send_message are your messages.
CLI tokens
A hash of each CLI token, with when it was created and last used. The token itself stays on your computer, in ~/.commitcity/config.json.
Beta waitlist
If you request closed beta access on our landing page: your email address, when you requested access and whether we approved it. We use your address to answer your request. Repo access can also create or approve this record at sign-in, without a waitlist request. After approval, we compare it with the verified email from GitHub to control access. We keep the approval while you use the beta. You can withdraw your request at any time by emailing us. Removing an approved request also removes beta access.
Emails to us
If you email us, your email address and what you write.
Technical data
Cloudflare delivers every page and request. It processes your IP address and the request to deliver it, to protect Commit City from attacks, and to limit how often the CLI and the MCP server can call it. Our own logs hold counts and error codes, and the internal id of each deleted account. They never contain tokens, chat text or the contents of GitHub webhooks.
Cookies
Commit City sets only the cookies it needs to keep you signed in: cc-session (your Supabase session, 7 days), cc-github-token (your encrypted GitHub token, 7 days) and short-lived cookies during sign-in. It also keeps one value in your browser's session storage, cc-resume-attempt, so that renewing an expired session doesn't reload the page in a loop. The browser deletes it when you close the tab. These are strictly necessary for the service you asked for, so under the Danish cookie rules we don't ask for consent. There are no analytics or advertising cookies.
What your teammates see about your agents
- Members of a building see when your agent works, waits for your input or stops. They see this on your desk, on the board and in the feed, with the agent session's branch and linked issue.
- The CLI sends only a session id, the agent, the agent state, the repo, the branch and the issue number. It never sends code, prompts, file names or tool output.
- Run commitcity uninstall to remove the hooks and the MCP server. Your agents then stop reporting. commitcity logout also deletes your CLI token.
Please keep sensitive data out of chat
Every member of a building can read its chat, and members can let their own agents read it through the MCP server. Their agent's provider, for example Anthropic or OpenAI, then processes it under that member's own agreement with the provider.
So please don't post sensitive personal data: health information, political opinions, religious beliefs, sexual orientation or other special categories (GDPR Art. 9), ID numbers, passwords or secrets, or other people's personal data that they wouldn't expect to be shared.
Why we use your data, and the lawful basis
| Purpose | Lawful basis |
|---|---|
| Run your account, buildings, agent sessions, board, feed, chat, the CLI and the MCP server | Contract, GDPR Art. 6(1)(b) |
| Store invites, and show the GitHub logins of people in a repo's GitHub events | Legitimate interest, Art. 6(1)(f): building admins can invite their teammates, and members see who did what in their repo |
| Keep Commit City secure: sign-in records, rate limits, logs and encrypted database copies | Legitimate interest, Art. 6(1)(f): protecting the service and your data against misuse and loss |
| Tell you about material changes to the terms, the end of the beta or a data breach | Contract, Art. 6(1)(b), and legal obligation, Art. 6(1)(c) |
| Handle reports of illegal content, complaints and requests about your rights | Legal obligation, Art. 6(1)(c): the EU Digital Services Act and the GDPR |
| Answer your beta access request | Consent, Art. 6(1)(a). You can withdraw it at any time by emailing us |
| Check approval when you use the closed beta | Contract, Art. 6(1)(b) |
| Answer your emails | Legitimate interest, Art. 6(1)(f): answering you |
| Keep emails, reports and our decisions for up to 3 years | Legitimate interest, Art. 6(1)(f): being able to show what happened if someone makes a claim. 3 years is the general Danish limitation period (forældelsesloven § 3) |
We make no automated decisions about you and don't build profiles.
If you use Commit City for work
We decide what Commit City stores, for how long and who sees it, so we're the controller even when your employer or a client asks you to use it. They're responsible for their own use of what they see in Commit City, for example if they use it to follow your work.
Who receives your data
- Members of your buildings see your login, avatar, agent sessions, messages and the feed events about you. Building admins also see the invites in their building.
- Supabase (Supabase Pte. Ltd., Singapore) runs our database, sign-in and live updates. The database is in an EU region. Supabase uses its own service providers, listed in its sub-processor list.
- Cloudflare (Cloudflare, Inc., USA) hosts Commit City and its network.
- GitHub (GitHub, Inc., USA) stores the encrypted nightly copies of the database.
- GitHub as a separate controller. You sign in with GitHub, Commit City reads your repos' issues, pull requests and CI results from GitHub, and it writes your claims to GitHub. GitHub handles your GitHub account under its own privacy statement.
- SpaceMail, provided by Spaceship, Inc., USA, delivers and stores the emails you send to support@commitcity.dev and the emails we send you.
- Authorities, when the law requires us to share data.
As our service providers, Supabase, Cloudflare, GitHub (for the copies) and Spaceship process data only on our behalf, under data processing agreements.
Transfers outside the EU
Supabase is a Singapore company, and Cloudflare, GitHub and Spaceship are US companies. Cloudflare handles requests in data centers around the world, and Supabase's service providers may reach the data from outside the EU. These safeguards cover the transfers:
- Supabase: the EU Standard Contractual Clauses (Commission Decision 2021/914) in the Supabase data processing agreement. Singapore has no EU adequacy decision, so these clauses are the safeguard.
- Cloudflare: the EU-US Data Privacy Framework (Commission Decision 2023/1795), with the Standard Contractual Clauses as a fallback, in the Cloudflare data processing addendum.
- GitHub: the EU-US Data Privacy Framework and the Standard Contractual Clauses, in the GitHub data protection agreement and its privacy statement.
- Spaceship: the EU Standard Contractual Clauses in its data processing addendum.
Email us for a copy of these safeguards.
How long we keep your data
A daily job deletes data whose period has ended.
| Data | Kept until |
|---|---|
| Account: GitHub user id, login, avatar, email address and name | You delete your account |
| Sign-in sessions | You sign out, 30 days after you last used them, or you delete your account |
| Sign-in audit log | 90 days, or you delete your account |
| Memberships | You delete your account, you lose access to the repo, or the building is deleted |
| Agent sessions | The session ends. A session that stops sending signals counts as ended after 30 minutes and is hidden, and the daily job deletes it within a day after that |
| Agent events and updates | 90 days |
| Messages, thread previews, GitHub events and system events | The building is deleted, or you delete your account (your messages and previews go, and your name is removed from events) |
| A building whose repo or app was removed, with all its data | 30 days after removal, unless the app comes back |
| Invites | Accepted, declined or 30 days after they're sent |
| CLI tokens | You run commitcity logout, sign out all CLIs in Settings, or delete your account |
| Waitlist emails and approval | Pending requests: until withdrawn. Approved requests: until account deletion or removal of access |
| Emails to us, reports of illegal content and our decisions on them | As long as we need them to handle the matter, and at most 3 years |
| Encrypted copies of the database | 7 days |
| The internal id of a deleted account, in our hosting logs | 7 days |
Your rights
You have the right to:
- get a copy of your data and information about how we use it (GDPR Art. 15), and get it in a machine-readable format (Art. 20)
- have wrong data corrected (Art. 16). Your login, avatar, name and email come from GitHub, so change them on GitHub and sign in again
- have your data deleted (Art. 17)
- have its use restricted (Art. 18)
- object to uses based on legitimate interest (Art. 21)
- withdraw consent at any time, without affecting what happened before (Art. 7(3))
To use a right, email support@commitcity.dev. We answer within one month. If a request is complex, we can extend that by up to two more months, and we tell you why within the first month. We may ask you to confirm that the account is yours, for example by writing from the email address on your account.
Deleting your account
In Settings, choose Delete my account. It deletes right away:
- your account with your email address, your memberships, agent sessions and CLI tokens
- your messages, your agents' updates and invites sent to you
- Supabase Auth's sign-in records and audit log entries about you
It also removes your name from feed events and from invites you sent, and removes thread previews that quote your messages. Those events and invites stay for the other members, without your name. Agent events stay until the 90-day cleanup, without your name.
On GitHub, it asks GitHub to remove your authorization of the Commit City app and the tokens GitHub issued for it. If that fails, the page after the deletion tells you, and you can revoke the app yourself under Settings, Applications, Authorized GitHub Apps. Nothing else changes on GitHub. Your claims stay, so you stay assigned to the issues you claimed.
Encrypted copies of the database expire within 7 days. Our hosting logs keep your account's internal id for 7 days, without your name or anything else. If we ever have to restore a copy made before you deleted your account, we use that id to delete it again.
If you don't use Commit City
You were invited
A building admin invited your GitHub login to their building. We store your login, the building, who invited you and when, so that you can see and accept the invite when you sign in. Our lawful basis is legitimate interest (Art. 6(1)(f)): the building admin wants to work with you in Commit City. The invite is deleted when you accept or decline it, or 30 days after it was sent, whichever comes first. To have it deleted sooner, email us.
You appear in a repo's GitHub activity
If you open or merge a pull request, close an issue or run CI in a repo that has a building, its feed stores your GitHub login with the title and link. The data comes from GitHub through the Commit City GitHub App. Our lawful basis is legitimate interest (Art. 6(1)(f)): members see what happens in their repo. It's kept until the building is deleted. You have the same rights as users. Email us to use them.
Complaints to the data protection authority
You can complain to Datatilsynet, the Danish Data Protection Agency, or to the authority in the EU country where you live or work.
- Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby, Denmark
- dt@datatilsynet.dk, +45 33 19 32 00, datatilsynet.dk
We'd like to hear from you first, so we can try to fix it.
Changes to this notice
When we change this notice, we update its version and date. We tell you about material changes by email or in the app before they take effect.