Privacy

This page explains how ShipRecap uses GitHub data. It is not certified legal advice and should be reviewed by counsel before you rely on it commercially.

What GitHub data we access

When you connect GitHub, ShipRecap requests read:user, user:email, and repo access. That lets us read your profile, email if GitHub provides it, and activity on repositories you can access — including private ones you choose to report on.

Why we access it

We use selected GitHub activity (commit messages, pull request titles, release names, and similar metadata) so you can generate a client-facing report. We do not use GitHub access to publish source code or to monitor employees.

What we store

We store your GitHub user id, username, avatar, email if available, projects you create, reports you generate, and an encrypted GitHub access token so we can fetch activity later. Tokens are encrypted at rest and are never sent to the browser.

What is sent to AI

Report generation sends a bounded list of selected activity titles (and similar short metadata) to a language model. Source code is never sent. We do not send commit hashes, private repository URLs, or file contents to the model.

What is published

Nothing is public until you explicitly publish a report. Published pages include the title, summary, shipped items, optional next steps, dates, and (unless you turn it off) activity counts. Commit hashes, tokens, private repository URLs, and source files are not included.

Disconnect and deletion

You can disconnect GitHub in Settings. That removes the stored token and does not delete your ShipRecap reports or projects. You can delete your account in Settings, which removes your ShipRecap data. If a subscription is active, we cancel it before deleting the account.

Billing is processed by Stripe. Analytics events do not include source code or commit contents.

Contact: privacy@shiprecap.app