Privacy Policy

The short version

GitDepth has no accounts and no cookies. We count anonymous pageviews to understand traffic — no individual profiles, nothing that identifies you. The only other data we handle is the source code you choose to analyze, processed temporarily to build your graph, then deleted automatically.

What we process

• Code you submit — a public GitHub repository URL, an uploaded ZIP, or a folder you select.
• Code snippets and questions sent to an AI provider when you request a plain-English summary, open Story View, or ask the chat a question — only if you've added your own API key.
• Your AI provider API key, which you enter in Settings.
• Anonymous pageview counts — which pages got visited and roughly how many distinct people visited them, with no cookies and nothing that identifies you individually (see "Analytics" below).

We don't require a signup, so we don't collect names, emails, or passwords to use GitDepth.

How it's processed

When you submit a repository, ZIP, or folder, it's downloaded or extracted into a temporary, per-job directory on our server so it can be parsed into a graph. Parsing needs no AI and no API key.

AI features — node summaries, Story View, and chat — run on your own API key for the provider you choose in Settings (currently Groq, OpenAI, or a custom OpenAI-compatible endpoint). That key is stored only in your browser's local storage. When you use an AI feature, your key and the relevant code snippet or question pass through our server and straight to your chosen provider for that one request — we don't log, store, or ever see your key at rest, and we don't attach it to anything else you do. Your provider then processes that request under its own policy — see Groq's or OpenAI's. If you point GitDepth at a custom endpoint, that provider's own policy applies instead.

Retention

Temporary job directories are automatically deleted on a 24-hour sweep. We don't keep a permanent copy of your code after that window, and we don't use it for anything other than generating your graph and answering your questions about it. Your API key is never written to disk on our end in the first place — it lives in your browser and passes through our server only in memory, for the length of a single request.

Analytics

We run our own pageview counter — no third-party analytics service ever sees your traffic. When you load a page, your browser pings our server with just the path (e.g. /app); the server computes a one-way hash of your IP address and browser combined with the current date, and stores that hash alongside the page and a timestamp. That hash changes every day, so it can never link your visits across two different days, even in our own database — the same method privacy-focused analytics tools like Plausible use. We never store your raw IP address, and there's no cookie involved. This gives us rough numbers like "how many people visited" and "how many pageviews" — never anything that identifies you, and no way to see what any one visitor specifically did.

Logs

Our hosting infrastructure may log standard request metadata (such as IP address and timestamps) for security and abuse prevention, the way most web services do. Beyond the pageview counter above, GitDepth does not add its own advertising or cross-site tracking scripts, and never sells or shares data with advertisers.

Changes

If this policy changes in a material way, we'll update the date at the top of this page.