Privacy Policy
Last updated: December 1, 2025
Overview
TalaFlow is committed to protecting your privacy. This policy explains how we collect, use, and safeguard your data.
Data We Collect
Account Information
When you sign in with GitHub, we collect:
- GitHub username and user ID
- Email address (if public on your GitHub profile)
- Profile avatar
GitHub Activity Data
To generate your weekly updates, we collect:
- Pull request data (titles, URLs, merge dates, additions/deletions)
- Commit data (messages, SHAs, dates)
- Issue data (titles, URLs, closed dates)
- Repository names and metadata
This data is collected only from repositories you explicitly configure in your settings.
Configuration Data
We store your preferences:
- Repository lists and exclusions
- Timezone and scheduling preferences
- Export destinations (Jekyll blog URLs, repository paths)
- Privacy settings (obfuscation preferences)
How We Use Your Data
Your data is used exclusively to provide TalaFlow services:
- Generate weekly activity summaries
- Export updates to your configured destinations
- Display your activity history in the dashboard
- Authenticate API requests to GitHub on your behalf
We never sell your data. We never share your data with third parties for marketing purposes.
Data Storage & Security
Your data is stored securely:
- Database: Supabase (PostgreSQL) with encryption at rest
- Access tokens: Encrypted using AES-256-GCM before storage
- Access control: Row-level security policies ensure you can only access your own data
- Hosting: Application hosted on Vercel with HTTPS/TLS encryption in transit
Private Repository Privacy
TalaFlow respects the privacy of your private repositories:
- Private repository data is never made public without your explicit consent
- You can enable obfuscation to hide private repository names in exports
- Obfuscation shows only aggregated statistics without revealing specific details
- You control which export destinations receive obfuscated vs. detailed content
Data Retention
TalaFlow ties everything it stores to your account and removes it on request. The table below summarizes how each data type is handled today:
| Data type | What happens now |
|---|---|
| Account profile & configuration | Stored while your account is active. When you delete the account we delete your user row, configuration rows, and linked metadata in Supabase. |
| Weekly updates | All generated updates remain in the database indefinitely today. The dashboard UI only displays as many weeks as your plan allows, but the underlying records stay until you delete your account. |
| Export logs | Automatically purged based on your plan tier: Free (30 days), Pro (1 year), Team (2 years), Enterprise (unlimited). A daily job removes logs older than your tier allows. |
| GitHub tokens | Stored encrypted (AES-256-GCM). Deleted immediately when you delete your account. |
FAQ: You can request account deletion at any time via the dashboard. That action deletes everything TalaFlow stores about you, though exports already pushed to other services remain under their control.
The UI’s “history limit” is a display filter, not a hard purge. If you need older updates removed sooner, deleting your account is the only way to wipe them today.
Your Rights
You have the right to:
- Access: View all data we've collected about you via your dashboard
- Export: Download your generated updates as Markdown files directly from the update cards
- Delete: Email privacy@talaflow.dev to request manual deletion of your TalaFlow data when you cancel your account; we'll remove everything from our servers, keeping exports you've already pushed elsewhere untouched.
- Modify: Update your configuration and preferences at any time
- Revoke access: Disconnect TalaFlow from your GitHub account at any time
Note: Deleting your account removes data from TalaFlow but does not delete exports you've already pushed to external repositories or blogs.
Third-Party Services
TalaFlow integrates with the following services:
- GitHub: For authentication and API access (see GitHub Privacy Statement)
- Supabase: For database hosting (see Supabase Privacy Policy)
- Vercel: For application hosting (see Vercel Privacy Policy)
Cookies
TalaFlow uses essential cookies for authentication and session management. We do not use tracking or advertising cookies.
Changes to This Policy
We may update this privacy policy as TalaFlow evolves. We will notify users of significant changes via email or dashboard notification. Continued use of TalaFlow after changes constitutes acceptance of the updated policy.
Contact
Questions about privacy? Contact us at privacy@talaflow.dev. TalaFlow is operated by K. Quinones (sole proprietorship).