Privacy Policy

1. Who we are

Recap Agent (“we”, “us”) turns your GitHub commits into daily recaps that you can review and send to your managers. It is operated by an individual developer based in Morocco, who is the controller of the personal data described here. Contact: ismailpipas@gmail.com.

This policy covers the Recap Agent web platform. The open-source recap-agent command-line tool runs on your own computer and sends us nothing.

2. What we collect

• Account: your name, email address and profile picture from the provider you sign in with (GitHub, Google or Microsoft), and the sign-in tokens that provider returns. Sign-in only requests identity access, never access to your repositories or mailbox.
• Sessions: a session record with its expiry, and the IP address and browser user agent it was created from.
• GitHub connection: when you connect GitHub as your commit source, an access token with the repo, read:user and read:org scopes, your GitHub login and account ID.
• Groq API key: the key you add so recaps are written with your own Groq account.
• Connected mailboxes: for each Gmail or Outlook mailbox you connect, its email address and the access and refresh tokens for the send-only permission (Gmail gmail.send, Microsoft Graph Mail.Send).
• Your content: the managers you add (names and email addresses), your schedules and their repository selection, generated recaps, the history of generation runs, and a log of every send (sender, recipients, time, outcome).

We do not store your commits. When a recap is generated we read them from GitHub, use them to write the recap, and keep only the recap.

3. How we use it

• To sign you in and keep you signed in.
• To generate recaps: we list the repositories you chose and read your commits for the day (repository names, commit messages and dates) from the GitHub API.
• To write the recap, we send those commit messages, shortened, to Groq with your own API key. Groq processes them under its own terms and privacy policy.
• To send a recap from your connected mailbox to the recipients you chose, through the Gmail API or Microsoft Graph, only after you confirm it or for a schedule where you explicitly turned on automatic sending.
• To email you about your own recaps (ready to review, sent automatically, or failed) through our email provider. We never send recaps to anyone through this provider, and we send no marketing email.

The legal bases are the performance of our agreement with you (the Terms of Service) and, for connecting GitHub and mailboxes, your consent, which you can withdraw at any time by disconnecting them.

4. Google and Microsoft user data

Recap Agent's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• We only request permission to send email. We cannot read, search, modify or delete the messages in your mailbox.
• We use that permission solely to send the recaps you confirmed, or opted into sending automatically, to the recipients you chose.
• We do not use Google or Microsoft user data for advertising, do not sell it, do not use it to train AI models, and do not transfer it to anyone except as needed to provide this feature, to comply with the law, or with your consent.
• No human reads your Google or Microsoft data, except with your permission or where the law requires it.

5. Service providers

We rely on these providers to run Recap Agent. They process data on our behalf, or on yours where noted:

• Vercel (web hosting, United States).
• Neon (database, Frankfurt, Germany).
• Railway (background worker that generates and sends recaps, Netherlands).
• Resend (notification emails to you, United States).
• GitHub, Google, Microsoft (sign-in, commit source and mailboxes, under your accounts).
• Groq (writing recaps, with your own API key and under your agreement with Groq).

Some of these providers process data outside Morocco and the European Union. We rely on their contractual and technical safeguards for those transfers.

6. Security

All traffic is encrypted in transit (HTTPS). GitHub, Groq and mailbox tokens and keys are encrypted at rest with AES-256-GCM, and sign-in tokens are encrypted at rest as well. Access is limited to what each feature needs. No system is perfectly secure; if a breach affects your data, we will notify you and the competent authority as the law requires.

7. Retention

• Your data is kept while your account exists.
• Disconnecting GitHub or a mailbox deletes its tokens immediately; Google tokens are also revoked with Google.
• Deleting a recap from your history also deletes its send log. Managers and schedules can be deleted any time.
• You can delete your account at any time with Delete account in the account menu (your avatar). This immediately deletes all your data and revokes access to your GitHub repositories and Gmail mailboxes. You can also ask us by email at ismailpipas@gmail.com.

8. Cookies and local storage

We use only what the service needs: session cookies to keep you signed in, a short-lived cookie that secures the GitHub and mailbox connection flows, and your browser's local storage for your light or dark theme. We do not use analytics, advertising or tracking cookies.

9. Your rights

Under Moroccan Law 09-08 on the protection of individuals with regard to the processing of personal data, and, if you are in the European Union, the GDPR, you can ask to access, correct or delete your data, object to or restrict its processing, and receive it in a portable format. Email ismailpipas@gmail.com; we answer within 30 days.

You can also complain to the Moroccan data protection authority (CNDP, cndp.ma) or, in the European Union, to your local data protection authority.

10. Children

Recap Agent is a work tool and is not intended for anyone under 16. We do not knowingly collect their data.

11. Changes

If we change this policy, we will update the effective date above, and for significant changes we will tell you by email or in the app before they apply. See also the Terms of Service.