privacy policy

• your account: your username, name, email address and profile picture.
• when you sign in with GitHub, Google or X: the account id, username, email address and profile picture that service shares with us. we never see your password there.
• when you sign up with email: your password, stored only as a salted, one-way hash. we can not read it.
• what you publish: your projects, updates, labels and launches.
• repositories you connect: commit messages from the repositories you choose, used to write draft updates. drafts from private repositories stay private until you approve them.
• basic technical data: like any website, our hosting keeps short-lived logs (address, browser, time) to keep the site running and safe.

your profile page, your username, name and picture, and every update, project and launch you publish are public. they appear in the live feed and can be found by search engines like Google. that is the point of the site, so please don't publish anything you want to keep private.

your email address and password are never shown publicly.

these are needed for the site to work, so they don't ask first:

• ct_session keeps you signed in for up to 30 days.
• ct_oauth lasts 10 minutes while you sign in with GitHub, Google or X.
• ct_gh_install lasts 30 minutes while you connect GitHub, and ct_invite keeps a team invite for up to 7 days.
• your browser also remembers your light or dark choice and your cookie choice (ct_theme, ct_cookies). these stay on your device and are never sent to us.

analytics, only if you accept. we use Google Tag Manager and Google Analytics to understand how people use commiToday. their cookies (_ga and _ga_*, kept up to 2 years) are set only after you press "accept" in the cookie notice. if you say no, nothing is stored on your device, and Google still receives basic, cookieless signals (such as a page being viewed) so we can count visits. we never use advertising cookies.

commiToday also counts views of updates itself, without cookies: we keep a one-way, salted fingerprint of the visit, never your address.

you can change your cookie choice at any time.

we don't sell your data or share it with advertisers. a few services handle it for us:

• MongoDB Atlas stores our database, in Frankfurt (EU).
• Cloudflare hosts and serves the site.
• GitHub, Google and X handle signing in, if you choose them.
• ShipDesk.dev receives your project when you choose to launch it there.
• OpenAI writes the AI rewrites, recaps and social posts you ask for, from your notes and commit messages. it doesn't keep them to train its models.
• Resend sends our emails, like welcome and password reset emails.
• Dodo Payments handles payments for paid plans. we never see your card details.
• Cloudflare Turnstile checks that sign-ups come from a person, not a bot.
• Google (Tag Manager and Analytics) measures how the site is used, as described under cookies.

we keep your account and what you publish until you delete them. sign-in sessions end after 30 days, or when you log out. when you delete your account, your data is removed from our database within 30 days.

you can ask us for a copy of your data, to correct it, or to delete your account and everything in it. email hello@commi.today and we'll answer within 30 days. if you are in the EU or UK, you also have the right to complain to your local data protection authority.

commiToday is for people who are 16 or older.

if we change this policy in a way that matters, we'll update the date at the top and tell signed-in users before it takes effect.