Skip to main content
Sign in

Privacy Policy

Last updated: October 11, 2026

Data we collect

When you sign in with GitHub or GitLab, we receive and store the following information from your provider profile:

  • Display name and avatar URL
  • Email address (if publicly available or authorized)
  • Provider username

To provide the service, we also store:

  • OAuth access and refresh tokens and personal access tokens, encrypted by the application using AES-256-GCM
  • Metadata about your monitored projects (names, URLs, namespaces)
  • Issue and merge request metadata (titles, states, authors, labels, review data, pipeline status)
  • Board history — a record of each card’s moves and state changes, including which account made the change and when. This is what powers board history and the analytics charts.
  • Webhook deliveries from GitHub and GitLab, held encrypted until they are processed. We keep only the parts the board uses: ids, titles, labels, states, branch names, timestamps, and the names, usernames and avatars of the people involved. Descriptions, comment text, commit messages, email addresses and file paths are removed before anything is stored.
  • Team membership: which teams you belong to and your role, pending invitations (the invitee’s email address or username), and the API tokens a team creates (we store a hash, never the token)
  • Sync logs (status, duration, error messages)
  • Session data (JWT-based)
  • Billing data, if your team subscribes to a paid plan: the Stripe customer and subscription identifiers, your plan, its status, the number of seats, and the renewal date. Card details are entered with Stripe and never reach GitGumbo.

If you write to us through the support page, we receive your name, email address, the topic and your message by email. We do not store them in GitGumbo; they stay in our support mailbox so we can reply.

GitGumbo does not access, read, or store your source code, and it does not keep commit messages or the files a commit changed.

How we use your data

  • To authenticate you and maintain your session
  • To sync issues, merge requests, and pipeline data from your connected accounts
  • To display your kanban boards
  • To register webhooks for real-time updates from GitHub and GitLab
  • To monitor sync health and diagnose errors

Legal basis for processing

We process your data on the following grounds:

  • Contract performance — processing necessary to provide the service you signed up for
  • Consent — you explicitly authorize access to your data via OAuth when you sign in
  • Legitimate interest — service operation, security, and error monitoring

Our role

We are the controller for your account: your sign-in and profile, your team memberships, billing, sync logs and the records we keep to run and secure the service.

For the content of a team’s workspace — the issues and merge requests it mirrors, its boards and its board history — we act as a processor for that team, which decides what is synced. If you appear in that content, for example as the author of an issue, a request about it is for that team to answer, and we will pass it on to them.

Data retention

  • Account data — retained until you delete your account, except for the categories given their own window below
  • Team content — retained while the project is monitored and the team exists. It belongs to the team, so it stays when one member deletes their account.
  • Board history — deleted automatically once an event is older than your plan’s history window: 7 days on Free, 90 days on Pro, 180 days on Team. This happens whether or not you delete anything yourself, and older events cannot be recovered.
  • Sync logs — automatically deleted after 30 days
  • Webhook deliveries — deleted as soon as they are processed. One that cannot be processed is deleted after 7 days.
  • Invitations — deleted after 30 days if not accepted
  • OAuth tokens — retained while your account exists, encrypted at rest
  • Sessions — expire after 30 days without use, or when you sign out
  • Backups — we keep recent daily backups of the database on our server, and an encrypted copy off-site. Deleting data does not edit backups that already exist, so it drops out of them only as they expire.
  • Operator records — a log of administrative actions on the service, and the identifiers of payment events we have processed, are kept with no fixed deletion date. If you were added to the sign-in allowlist, that entry stays until we remove it.

Third parties

We share data with the following third-party services solely to provide the service:

  • GitHub (github.com) — source of issues, merge requests, and webhook events
  • GitLab (gitlab.com) — source of issues, merge requests, and webhook events
  • Stripe (stripe.com) — payment processing for paid plans. Receives your GitGumbo user and team identifiers, plus the email address and payment details you give it directly at checkout. Where a checkout is marked “Sold through Onelink”, Sold through Link, LLC — a Stripe affiliate — is the merchant of record for that payment: it takes the payment, issues your receipt and invoice, and handles support for the transaction. It uses those details as Stripe determines — for the payment itself, order management, tax remittance and customer support — rather than only on our instructions, under its own customer terms at onelink.com/terms
  • Cloudflare (cloudflare.com) — sits in front of the site and carries every request to it, so it sees your IP address and browser details. On the support page it also runs Turnstile, a check that you are not a bot, which reads signals from your browser to decide. Questions you ask the support assistant, with the rest of that conversation, are sent to Cloudflare Workers AI to write the answer; we do not store them
  • Sentry (sentry.io) — error monitoring. Receives error reports, which can include your user and team identifiers, the page you were on, and your browser details
  • Hetzner (hetzner.com) — hosting. Runs the application, the database and the background worker on servers in Helsinki, Finland, so everything the product stores is held there
  • Backblaze (backblaze.com) — off-site backup storage. Holds a copy of the database, encrypted on our server before it is uploaded, which Backblaze cannot read
  • Our email provider — delivers transactional email such as team invitations, and the messages you send from the support page. Receives the recipient’s address and the contents of that message

We do not use analytics or advertising services, and we never sell your data. Apart from the services listed above, we do not share it with any other third parties.

Your rights

Under the GDPR and similar data protection laws, you have the right to:

  • Access your data — you can export it at any time from your account settings. The export covers your profile and preferences, your connected accounts, your memberships, your own settings and API tokens in every team you belong to, and the boards in your personal workspace. It does not cover teams you have left, or a team’s shared content; ask us at the address below for those.
  • Erasure — you can delete your account from your account settings. That deletes your profile, connected accounts, memberships and personal workspace, cancels your personal workspace’s subscription, and asks GitHub or GitLab to revoke our access. If you are a team’s only owner, ownership passes to its longest-serving admin, or member if there is no admin; a team with nobody left in it is deleted and its subscription cancelled. Any API token you created for a team stops working as soon as you are no longer its member. Some records outlive your account: a team’s content stays with the team, including your name and avatar in its issues; so do the operator records and backups described under Data retention.
  • Data portability — your data export is provided in a machine-readable JSON format
  • Rectification — profile information is sourced from your GitHub or GitLab account and can be corrected there
  • Restrict processing — you can disable sync for individual projects. We then stop fetching that project and stop keeping its webhook deliveries, unless another team syncs the same repository.
  • Object to processing — contact us at the address below
  • Lodge a complaint with your local data protection supervisory authority

One limit worth knowing: if you bought a paid plan through a checkout marked “Sold through Onelink”, the payment provider holds its own record of that purchase. Deleting your GitGumbo account removes our copy but does not reach theirs. They handle deletion requests for the data in their systems themselves, and tell us once they have acted. Ask us either way and we will point you to the right place.

Cookies

GitGumbo sets three first-party cookies. All three are strictly necessary for signing in, and none of them are set for any other purpose:

  • Session (authjs.session-token) — keeps you signed in
  • CSRF token (authjs.csrf-token) — a security control that stops another site from submitting the sign-in form on your behalf
  • Callback URL (authjs.callback-url) — remembers where to return you after you sign in

The CSRF and callback cookies are set as soon as you open the sign-in page, before any session exists. Over HTTPS your browser will show them with the __Host- and __Secure- prefixes. We do not use tracking cookies, analytics cookies, or any third-party cookies.

Data security

Everything the product stores is on an encrypted disk: the database, the cache, the local backups and the service’s own secrets. The disk unlocks only by reaching a key server kept off that machine, so a copied disk, a snapshot or a stolen drive cannot be read on its own. Copies made before the disk was encrypted were deleted from the server.

Inside the database, the application encrypts the most identifying fields again, using AES-256-GCM: OAuth and personal access tokens, issue and merge request titles, milestone titles, branch names, the snapshots of linked issues, and queued webhook deliveries. This is encryption at rest: the application decrypts your data to show it to you, so it is not end-to-end encryption. All traffic is served over HTTPS. We do not access or store your source code. A team’s data is available only to that team’s members and to API tokens created for that team, and the database enforces that separation as well as the application. We access it ourselves only where running or supporting the service requires it.

Children

GitGumbo is not directed at children under the age of 16. We do not knowingly collect personal data from children.

Changes to this policy

We may update this Privacy Policy from time to time. Any changes will be reflected on this page with an updated date. Continued use of GitGumbo after changes are posted constitutes acceptance of the revised policy.

Contact

The data controller for the personal data described in this policy is Ssh Apps Limited, a company registered in England & Wales under company number 07083275, whose registered office is Spitalfields House, 1 Stirling Court, Stirling Way, Borehamwood, Herts, WD6 2FX.

If you have any questions about this policy or wish to exercise your data rights, please reach out at [email protected].