Legal
Privacy Policy
Effective date: August 12, 2026
This policy explains what personal data gitdash (“we”, “us”) processes when you use this website, why we process it, and the rights you have under the EU General Data Protection Regulation (GDPR) and similar laws. We keep processing to the minimum needed to run the service.
1. Who we are
gitdash is the data controller for the personal data described in this policy. You can reach us at [email protected].
2. Data we process
When you browse without signing in
You can view the landing page and the demo dashboard without an account. In that case we process only the technical data required to serve pages (such as your request metadata) and the cookies listed below. We do not run advertising, and we do not use fingerprinting or cross-site tracking.
When you sign in with GitHub
To provide your personal dashboard we process:
- Identity data — your GitHub user ID, username, display name, avatar URL, and the email address GitHub shares with us during sign-in.
- Credentials — the access token GitHub issues for this application, stored encrypted on our server. Tokens are never placed in your browser.
- Repository and organization data — fetched on demand from the GitHub API with your credentials so we can display the repositories and organizations you can access. This data is rendered for you; it is not stored beyond what your dashboard preferences require.
- Preferences — your theme choice, linked organization, dashboard layout, and widget configuration, stored against your account so the product looks the way you set it up.
- Session data — a signed, HTTP-only session cookie that keeps you signed in.
3. Cookies
We only use first-party cookies. There are no third-party advertising or tracking cookies.
| Cookie | Purpose | Category | Lifetime |
|---|---|---|---|
gh_session | Keeps you signed in after authenticating with GitHub. | Strictly necessary | 7 days |
gh_cookie_consent | Remembers your cookie consent choice so we do not ask again. | Strictly necessary | 12 months |
Strictly necessary cookies do not require consent. If we ever introduce optional cookies (for example product analytics), they will only be set after you accept them in the cookie banner. You can change or withdraw consent at any time with the “Cookie settings” link in the footer — withdrawing consent is as easy as giving it.
4. Why we process your data (legal bases)
- Performance of a contract (Art. 6(1)(b) GDPR) — to operate your account, keep you signed in, and show you the repositories and organizations you choose to connect.
- Legitimate interests (Art. 6(1)(f) GDPR) — to secure the service, prevent abuse, and debug problems. Our interest is a safe, functioning product; we balance it against your rights and do not use it for profiling.
- Consent (Art. 6(1)(a) GDPR) — for any optional, non-essential cookies you choose to accept. You may withdraw consent at any time.
- Legal obligations (Art. 6(1)(c) GDPR) — where we must respond to lawful requests.
5. How your data is protected
- GitHub access tokens are encrypted at rest (AES-256-GCM) and never sent to browsers.
- The session cookie is HTTP-only, signed, and protected against cross-site request forgery.
- All GitHub API calls that need credentials happen on our server, not in your browser.
- The service requests read-only GitHub permissions; it does not ask for write access.
6. Sharing and transfers
We do not sell personal data and we do not share it with third parties for their marketing. Your dashboard content comes from the GitHub API; GitHub acts as an independent controller for the data held on its platform — see GitHub’s Privacy Statement. Because we call the GitHub API to fetch your data, some processing occurs in regions where GitHub operates, including the United States.
7. Retention
- Sessions expire after 7 days of inactivity.
- Account records, preferences, and layouts are kept while your account exists.
- Cookie consent records are kept for 12 months, then you are asked again.
When you ask us to delete your account, we remove your profile, credentials, preferences, and layouts from our systems.
8. Your rights
Depending on where you live, and in particular under the GDPR, you have the right to:
- access a copy of your personal data (Art. 15);
- correct inaccurate data (Art. 16);
- request erasure of your data (Art. 17);
- restrict processing (Art. 18);
- receive your data in a portable format (Art. 20);
- object to processing based on legitimate interests (Art. 21);
- withdraw cookie consent at any time via “Cookie settings” in the footer.
To exercise any right, email [email protected]. We will respond within one month. You also have the right to lodge a complaint with your local data protection supervisory authority.
9. Children
The service is not directed at children under 16, and we do not knowingly collect their personal data.
10. Changes
If we make material changes to this policy we will update the effective date above and, where appropriate, notify you in the product or ask for consent again.