Last updated 1 November 2026

Privacy

This page describes what actually happens, checked against the code that does it. If you find a difference between this page and the product, the product is the bug — write to us and we will fix one of the two.

What we store

Your address

Signing in needs an email address, and we keep it. There is no password to store. The six-digit codes are kept hashed and expire in ten minutes; your session is a cookie whose token we also only ever hold as a hash.

What is on your board

Tasks, their specs, the zone map you agreed with your agent, grants, access requests and the event record of what was decided and when — and with them the audit record each close writes, the paths of the files each task touched, hand-in notes and the pull requests linked to each task. With the Claude Code plugin installed, the agent's last message each time it stops on a task branch is kept too: cut at 19,000 characters, the latest 20 per task. This is the product — it is the reason the board exists — and it is yours. We do not read it to build anything else, and it is not used to train any model.

The operator can open a board read-only to help with support. Each time that happens, it is written into that board's own event log. That record is on by default, and the operator can switch it off; while it is off, a support view leaves nothing in the board's log.

Machines you connect

When you pair a machine or create a connector, we store a hash of its token, the label you gave it, who paired it and when it was last seen. The token itself we cannot recover — which is also why revoking is the only remedy if one leaks, and why the machines table on the pairing page shows you every one that exists.

If you filled in the form on the home page

Your address, which harness you use and roughly what size of team — and, recorded with them, the site that sent you here (its host name only, never the full address), which version of the page you saw, and when you signed up. Sending the form again with the same address changes nothing we stored. In our own database, used to decide who is invited and what gets built next.

What we do not do

• No analytics unless you say yes. This site can measure which pages are read, using Google Analytics through Tag Manager — and it loads nothing at all until you accept. Not "loads with tracking switched off": no request to Google is made, so they never see your address. Decline and the page works identically. Check it in your network tab.
• No advertising, no list rental, no sale of anything.
• No profiling and no automated decisions about you.

Cookies

Three kinds, and only the last one waits for your yes:

• Signing you in. One cookie, set when you sign in to the console and removed when you sign out. It is what keeps you signed in, so it is not optional and there is nothing to consent to — without it there is no session.
• Your answer to this question. Your accept or reject is stored in your own browser, not on our servers, so we can stop asking. Clearing your site data forgets it and the banner returns.
• Analytics, only after you accept. Google Tag Manager loads Google Analytics, which sets its own cookies (_ga and friends) to tell one visit from another. Google is the controller of what those collect; their terms govern it. Change your mind from Cookie settings in the footer of the site's pages — withdrawing is one click, the same as granting — and the ones we can reach are deleted on the way out. The documentation under /docs/ loads no analytics at all, so it has no such link.

Who else sees it

Four, and only these four:

• Cloudflare hosts the service and stores the database, and delivers the sign-in code to your inbox. Since 13 October 2026 it also turns each task's title, goal, criteria, expected files and the start of its notes — and the text of each related-task search — into vectors with a model it runs (Workers AI, bge-m3), so the board can find related tasks, and keeps those vectors (Vectorize). Everything above lives there.
• Anthropic — not today. No model is configured on this board (checked on 9 October 2026), so drafts are written by rules on our side and nothing goes to Anthropic. If one is configured, the board drafts a task's spec — and the proposals of cycle seed and cycle challenge — through Anthropic's API. Every task filed through the console, the CLI or the API is then sent automatically, without you asking: its title and your zone map (each zone's id, name, paths, risk level and default policy), so the board can suggest a spec. Asking for a draft yourself sends the line you typed and the same zone map. cycle seed and cycle challenge, when you run them, send a brief of the repository they run in: the first 50 lines of its README, the package name, script names and workspaces from its package.json, its 20 largest folders by file count and its last 20 commit subjects. cycle seed adds the paths of up to 2,000 tracked files, and cycle challenge the topic and description of each playbook you already have.
• GitHub, and only for a repository whose owner has connected its pull requests to the board (the CommitCycle GitHub App, and the pr.open setting for opening them). The board then opens the task's pull request, with the task's title and goal in its description; reads the list of files a pull request changed; and can post a check result on it, naming the task, its title and the zones it declared and touched. GitHub sends back each pull request's number, title, state, branch and link, which the board keeps with the task.
• Google, only on this marketing site and only if you accepted analytics; decline and it is not. The console, like the operator's own console and this site, loads its typeface (Plus Jakarta Sans) from our own servers, so opening it sends Google nothing.

How long it stays

Board content stays until you ask us to delete it — the product has no delete for a task, which can be Canceled but not removed. A sign-in code stops working after ten minutes, but the record that it was sent — your address, the code's hash and when — is kept. Sessions end when you sign out, when you end them from another session, or after 30 days. Revoked machines stay listed, deliberately: the record that something was connected is part of what an audit trail is for. Cloudflare also keeps its own logs of requests to the service and to this site, because its Workers logging is switched on, for as long as its retention lasts.

Getting it back, or getting rid of it

Write to paulo@commitcycle.com and ask for a copy of your data or for it to be deleted. We will do it, and we will tell you when it is done. If you are in the EU or the UK you have these rights by law; you have them here regardless of where you are, because two policies would just mean the worse one is the real one.

You can also download a board yourself, as one Markdown file: cycle export, or the export in the console.

Who operates this

CommitCycle is operated by the maintainer of the CommitCycle project, reachable at paulo@commitcycle.com, which is the address for privacy questions, deletion requests and legal notice.

Stated plainly because it matters to anyone deciding whether to trust this: a registered company entity and its jurisdiction are not published here yet. If your policy requires a named legal counterparty before you connect a repository, that requirement is not met today — and we would rather you knew that from this page than found out later.

Changes

If this page changes in a way that affects what we do with your data, we will write to the address you signed in with. The date at the top is the date it last changed.