Privacy

This is a plain-language summary for the StackUP prototype, not legal advice.

What we collect

Your account details (name, email, hashed password) and profile (username, display name, avatar link, time zone). If you connect GitHub: daily commit counts from public repositories. If you connect Claude Code or Codex with the CLI: per-session start and end times, active minutes, token counts, model names, the name of the project folder, and how many commits you authored in your local git repositories per day.

What we don't collect

StackUP requests only read:user and user:email from GitHub, so it cannot read code. The CLI never uploads prompts, responses, code, file paths or commit messages. Photos you add to a card are combined in your browser and never uploaded.

How tokens are handled

GitHub OAuth tokens stay on the server, are encrypted at rest, and are never displayed. CLI tokens are stored only as a SHA-256 hash and can be revoked in Settings. Disconnecting GitHub deletes the stored token and the commit counts imported from it.

Your controls

Nothing about you is public until you create a card. Each card has an unguessable link and shows the numbers frozen at the time you made it; deleting it makes the link stop working. Deleting your account removes all of your data.