Privacy

The software

This site runs gitbay, a self-hosted, CLI-first git forge. The software makes no external requests from your browser: no analytics, no CDNs, no webfonts, no tracking of any kind. Everything you see is served from this host.

What the server stores is what a forge needs to function: your account (username, email addresses, public SSH/PGP keys), the repositories and their contents, issues, merge requests, comments, and a security audit log of account and repository actions (recording the acting user, the action, and the public key fingerprint used). Web sessions use a single cookie, only after you log in. Private repositories are visible only to accounts you grant; to everyone else they are indistinguishable from nonexistent.

Your data is portable by design: gitbay auth export downloads your account bundle, git data is yours by clone, and gitbay migrate moves everything to another instance. gitbay auth delete, or the bottom of the settings page, deletes the account seven days after the mailed link is opened; what it wrote on other people's repositories stays, attributed to ghost.

The mobile client

The iOS app is a client for an instance you name at sign-in. It has no account of its own, no sign-up, and no server of ours behind it: it speaks only to that instance, over HTTPS.

Signing in stores one API token in the device Keychain. Which account is active is kept in app preferences; nothing else is retained on the device. The app embeds no analytics, no crash reporting, and no third-party SDK, so there is nothing to opt out of. Removing the account deletes the token from the Keychain.

Tokens are minted over SSH or on the settings page and can be revoked at any time with gitbay auth token revoke, which ends the app's access immediately.

This instance (gitbay.org)

This instance is run by one person on a single virtual machine at netcup in Nuremberg, Germany. Data lives in the European Union and is subject to the GDPR. Nothing sits between your browser and this host: no CDN, no reverse proxy, no scrubbing service.

Backups run nightly. The database and every repository, private ones included, are encrypted on this host and then stored at Scaleway in Paris. The key never leaves this machine, so the storage provider holds ciphertext it cannot read. Backups are kept for seven days, then weekly for a month and monthly for six. This host can add backups but is not permitted to delete them.

Five other things leave this host. Verification and notification mail is sent through Amazon SES, run by Amazon Web Services in Ireland, which sees the recipient address and the message. Replies to notification mail arrive at a mailbox hosted by Migadu, which sees the reply and its sender; this host collects them from there. TLS certificates come from Let's Encrypt. Push mirrors and webhooks connect wherever a repository owner pointed them. If you register an iOS device for notifications, the text of each notification is sent to Apple in the United States to reach it. That text names the repository and the item, private repositories included, and appears on the lock screen. Removing your devices in Settings stops it. Nothing else makes an outbound request.

IP addresses are recorded only when SSH authentication is rejected or rate-limited, in the audit log. A successful action records the account and the key fingerprint used, not the address. There is no HTTP request log. The audit log is not pruned; it is kept for as long as the instance runs. A web login session lasts seven days.

Registration is open. An account needs an SSH public key and an email address, which is confirmed by a code mailed to it; the address is stored whether or not you confirm it. To have an account deleted, with its keys, email addresses, and sessions, write to privacy@gitbay.org. Deletion is permanent.