Privacy

What we store

Your account (email, display name, avatar). Per-day summaries and the highlights that go with them. Commit counts and an hour-of-day histogram used to draw activity charts. Non-commit work you log by hand. Your settings, schedule, and repository rules.

We do not store the contents of your files, diffs, or full commit histories.

What is sent to an AI provider

Commit messages, the repository name, line-count totals, and any non-commit work you logged for that day. These go to whichever provider you configured, using your own API key. If you configure a local model through Ollama, nothing leaves the machine running it.

We do not send file contents or diffs to any model.

Credentials

GitHub, GitLab and Google tokens, AI provider keys, tracker and calendar credentials, and any database password you supply are stored so that scheduled runs can work while you're not signed in. They are encrypted at rest with AES-256-GCM using a key that lives outside the database, and are readable only by your own account through row-level security.

If you run Devlog yourself, set SECRETS_ENCRYPTION_KEY before anyone signs in — without it, tokens are stored as-is.

Workspaces and your employer

When you join a workspace, entries you write from then on are visible to that workspace's managers. Entries from before you joined, and entries you write after leaving, are not.

A workspace can restrict which repositories count as its work. Where that list is set, work outside it never reaches the workspace's reports.

Public profiles

Public profiles are off until you publish one, and show aggregates only — counts, streaks, and a rhythm chart. No commit message, summary, or highlight is reachable from a public profile. Hours and project names are additionally opt-in, and off by default.

Deleting your data

Settings → Delete account removes your account and everything keyed to it. Entries already written into a workspace report are retained by that workspace as its own business record.