Privacy policy

What we store

• From the provider you sign in with (GitHub, GitLab or Codeberg): which provider, your user id and username there, your display name, your email address if the provider gives it to us, and your avatar URL.
• Access and refresh tokens for the read-only access you grant, encrypted at rest.
• Repository and commit data: repository names, when they were last active, which ones you exclude, and per-day commit stats: commit counts, lines added and deleted, languages and commit hashes. We never store the contents of your code.
• What you add: day notes, day images and the share links you create.
• Account details: your time zone and the zone of each day, your role (such as beta tester), the events you join and your progress in them, when you last agreed to the terms of service, and any suspension or ban, with its reason and our internal note on it.
• In your browser: a signed session cookie, which is needed to keep you signed in (it lasts up to 30 days), and your light or dark theme choice, kept in your browser's local storage. We use no analytics and no advertising cookies.
• Your IP address is used in memory to limit how many requests one address can make, and can appear in short-lived server logs. It isn't stored with your account.

A share link shows that day's note, image, commit counts and languages to anyone who has the link, without your name, username or time zone. It stays public until you stop sharing it or delete your account. After the event's 2-year hosting period (see How long we keep it), the link shows only the day's commit counts, languages and the event's name.

Reports

Anyone can report a shared day, with or without an account. A report stores the reason, any details and contact the reporter gives, the reporter's account if they are signed in, which day it is about and whose it is, and a copy of that day's note and the name of its image as they were when it was reported. The reporter's IP address is held briefly in memory to limit how many reports one address can send; it isn't stored.

Reports, and the reported content they quote, are kept as a moderation record, including after the reported account or the reporter's account is deleted. Deleting an account removes its link to the report, not the report. Records of our moderation decisions about an account (what was done, when and why) are kept the same way.

Why we use it

• To provide Codecember to you under the Terms of service: signing you in, reading your commit history, showing your progress, and keeping and showing your notes, images and share links.
• For our legitimate interest in keeping the service secure and working: rate limits, logs, backups and enforcing the Content policy.
• Where the law requires us to, for example to answer a valid legal request.

We don't sell your data, don't use it for advertising, don't use it to train AI and don't send you marketing email.

Where it is stored

The app and its database run on Fly.io in the ewr region (the New Jersey area, United States). Day images are stored in Cloudflare R2 and served through Cloudflare's network.

Who else handles it

• GitHub, GitLab and Codeberg sign you in and provide the read-only API we read your commit history from. Their own privacy policies apply to your accounts there.
• Fly.io hosts the app and database, and Cloudflare stores and serves images. They process data for us as service providers.

Your data is stored and processed in the United States. If you are in the EU, the UK or another country with transfer rules, it is transferred to the US under those providers' data-processing terms.

How long we keep it

Your notes and images for an event's days are kept until 2 years after the event ends, then deleted. Share links stay after that, and then show only the day's commit counts, languages and the event's name. Stop sharing still deletes a link. Your account, stats and event history stay while your account exists, and deleting your account deletes everything, as described next. We don't send an email before notes and images are deleted: Codecember shows a notice in the app before then, and you can keep a copy at any time with Download my data (see Your rights).

When you delete your account, your profile, connected accounts and tokens, repositories, stats, event participation, day notes, images and share links are deleted at once, cached image copies are cleared from Cloudflare, and Codecember's access is revoked on GitHub and GitLab. On Codeberg, remove Codecember under Applications in your Codeberg settings. Reports about your shared days stay, as described under Reports.

If we ban an account for breaking the Content policy, its notes, images, share links, connected accounts and tokens, repositories and stats are deleted as they would be on account deletion. We keep the account's profile, the reason for the ban, and the provider and user id of each GitHub, GitLab or Codeberg account it used, so those accounts can't sign up again. The ids are kept even if the account is later deleted.

Copies of the database in backups are removed as the backups expire: daily snapshots are kept for 14 days, and the few copies taken before each update are kept for a limited time. We only use backups to recover from failures.

How to delete your data

Sign in, open Settings and choose Delete account. You can also stop sharing a single day, or clear a day's note or image, at any time.

Your rights

For a copy of your data in a portable format, sign in, open Settings and choose Download my data. It holds your day notes, images and daily commit stats. To ask for anything else, such as correcting your data or objecting to how we use it, write to [contact address: coming soon] . We answer within one month.

If you are in the EU or the UK, you can also complain to your data protection authority (in the UK, the Information Commissioner's Office).

Children

Codecember is for people aged 13 and over. If you are under the age of digital consent where you live (up to 16 in some EU countries), you need permission from a parent or guardian. See Who can use it in the Terms of service.

Changes to this policy

We announce material changes on the site before they apply. The date at the top of this page shows when it last changed.

Contact

Questions about your data: [contact address: coming soon] .