Privacy

The short version

We record that work happened, such as a pull request merged, a review approved, or a deploy finished, and who did it, so it can be counted and rewarded. We do not read the contents of your repositories, your messages or your issues, and we do not store your code.

Who is who

For the people who use the product inside a customer organization, the customer is the controller and we are a processor acting on their instructions. Those instructions and our obligations are set out in the Data Processing Addendum.

For visitors to this website and for people who contact us directly, we are the controller. That is the part this page is mainly about.

What we collect

From the product

• Event records. That something happened, when, in which repository or channel, and the identifier of the account that did it. Titles and references where the source sends them; never file contents.
• Account details. Name and email address, supplied by your organization’s identity provider, plus the source accounts linked to you so work can be attributed to the right person.
• Derived aggregates. Daily and all-time totals per person, per team and per metric, and the cards those totals earned.
• Audit records. Who changed a setting, and when.

From this website

Requests to these pages are served from a content delivery network, which processes the usual request metadata, such as IP address, user agent, and the page requested, in order to serve and secure the page. We set no advertising cookies, run no third-party analytics or tracking pixels, and there is no cookie banner because there is nothing to consent to.

What we do not collect

• File contents, diffs, or anything else from inside a repository.
• The text of Slack messages, beyond the karma expression itself and the identifiers needed to attribute it.
• Keystrokes, screenshots, screen time, location, or anything resembling activity monitoring.
• Card numbers. Payments go to Stripe, which holds them; we keep a customer and subscription identifier and nothing else.

Why we have it

To provide the product: to count work, rank teams, award cards and show someone their own contribution. To keep the service running and secure, including error reports that identify a tenant and a user by identifier rather than by name. And to answer you when you contact us.

Where a lawful basis is required, it is the performance of a contract with your organization, or our legitimate interest in operating and securing the service. We do not sell personal data, and we do not use it to train models.

How long we keep it

• Raw events: thirteen months. The monthly partition holding them is then dropped.
• Aggregates and cards: for the life of the account. This is why a leaderboard can have a longer history than our payload retention.
• Audit records: for the life of the account. A log that expires answers fewer questions than one that does not.
• Error reports: on our error provider’s retention schedule, typically 90 days, and identifiers only.

Who else touches it

The full list of subprocessors, covering hosting, database, authentication, error reporting and email, is on the security page, kept current there rather than in two places. All are in the United States. If we add one, that page changes.

Your rights

If you use the product through an employer, they control the data and your request is usually best made to them; we will help them answer it. Where you deal with us directly, you can ask us to give you a copy of what we hold, correct it, or delete it. Both an export and full tenant deletion are built into the product rather than being a manual favour.

Write to [email protected]. We will respond within 30 days, and normally much sooner.

International transfers

Data is stored and processed in the United States. If you are in the United Kingdom or the European Economic Area, that is a transfer, and it is covered by the standard contractual clauses incorporated into the DPA. If data residency in a particular region is a requirement, tell us before you start rather than afterwards.

Children

This is a workplace tool. It is not directed at anyone under 16 and we do not knowingly collect their data.

Changes

If this policy changes materially we will say so before it takes effect rather than silently updating the date at the top. The date at the top is the last time anything on this page changed at all.