Privacy Policy
This Privacy Policy explains what personal information Kompose collects when you use the Upd.dev code hosting and package distribution platform, why we collect it, how we use and share it, how long we keep it, and what rights you have over it. It forms part of the Terms of Service.
1.Scope and Controller
Kompose, a stock corporation organized under the laws of the State of California (entity number 6389732), is the data controller responsible for personal information processed through the Service. This Policy applies to the Upd.dev website, the hosted Git forge, the package registries, the application programming interfaces, and all related infrastructure operated at upd.dev and its subdomains.
This Policy does not apply to third-party services you reach through the Service, to the destinations of webhooks or integrations you configure, or to independently operated instances of the underlying open-source software. Those are governed by their own privacy practices.
Where you use the Service to process the personal information of others — for example, in an issue tracker for your own project — you act as the controller of that information and we act as your processor in respect of it.
2.Our Principles
We built Upd because we were tired of platforms that treat developers as inventory. Our approach to privacy follows from that:
- We do not sell your personal information. Not to advertisers, not to data brokers, not to anyone. There is no advertising business behind this Service.
- We collect what the platform needs to function, and error and performance telemetry to keep it working. Not more, and not speculatively. That telemetry stays on our own network.
- We do not audit your process. We do not analyse your code to profile you, we do not scan your repositories to infer your interests, and we do not build behavioural advertising profiles.
- We do not train models on your code. We do not use your repositories, packages, issues, or communications — public or private — to train machine learning models, and we do not license or sell them to any third party for that purpose.
- The platform is open source. You can read the code that handles your data at /upd/upd-forgejo. Most of what this Policy describes is verifiable rather than merely asserted.
3.Information We Collect
3.1 Account and profile information
When you register an Account, we collect and store:
- your username and any lower-cased normalization of it, together with a record of prior usernames so that old links continue to resolve;
- your primary email address and any additional email addresses you add, together with their verification status and your preference as to whether they are shown publicly;
- a cryptographic hash of your password, together with the hashing algorithm and per-user salt values. We never store your password in plain text and cannot recover it;
- optional profile details you choose to provide: full name, pronouns, location, website, biography, and avatar image;
- account state and preferences: interface theme, language, diff view style, email notification preferences, profile visibility, activity visibility, activation and administrative flags;
- timestamps: account creation, last update, last login, and email verification.
3.2 Authentication credentials and keys
To let you authenticate and sign your work, we store:
- SSH public keys, their fingerprints, names, and verification status;
- GPG public keys, their key identifiers, associated email addresses, and capability flags;
- personal access tokens, stored as salted hashes together with their scope, name, and last eight characters for identification;
- two-factor authentication secrets and scratch codes, and WebAuthn or passkey credential identifiers, public keys, and signature counters;
- session records and long-lived «remember me» authorization tokens, stored as hashed validators.
3.3 Third-party sign-in information
If you sign in through GitHub, GitLab, or another supported identity provider, we receive and store the identity data that provider releases to us: your external account identifier, provider name, email address, display name, nickname, avatar URL, and any profile description or location the provider includes. We also store the raw profile payload returned by the provider, and the access and refresh tokens issued for the connection, so that the connection continues to work.
We request the narrowest scopes necessary to authenticate you. We do not gain access to your repositories on that provider unless you separately authorize a migration or mirror.
3.4 Content you create
We store the content you place on the Service: repositories and their complete Git history, commits and the author and committer identities recorded within them, branches, tags, releases, packages and their metadata, issues, pull requests, code review comments, wiki pages, attachments, and repository and organization settings.
Git commit metadata deserves a specific mention. Commits carry the author name and email address configured in your local Git client at the time of the commit. That information is part of the commit object, it is cryptographically bound into the repository history, and it becomes visible to anyone who can read the repository. If you do not wish to publish an email address this way, configure Git with an address you are content to disclose before you push.
3.5 Activity and operational records
We record activity necessary to operate, secure, and audit the Service:
- an activity feed of repository and account events — pushes, repository creation, issue and pull request activity, releases — with actor, repository, event type, and timestamp. You may suppress the public display of your activity in your account settings;
- notification records and, unless disabled, contribution heatmap data;
- authentication events, including SSH connection attempts recorded with the connecting network address and the key fingerprint offered, and failure diagnostics for third-party sign-in including the user agent string of the request;
- webhook delivery records, including the request payload, the request sent, and the response received from the destination you configured;
- migration and import task records, including the parameters you supplied;
- abuse reports and moderation records, including a preserved copy of reported content and the identity of the reporting user;
- administrative and system notices.
3.6 Technical and network information
Our infrastructure, network, and content delivery providers process technical information inherent in serving a request over the internet: your IP address, request timestamp, requested resource, protocol, response status, transferred byte counts, user agent string, and TLS parameters. This is retained at the infrastructure layer for security, abuse prevention, capacity planning, and debugging.
3.7 Communications
When you write to support@upd.dev or otherwise contact us, we retain the correspondence, your contact details, and any information you include, so that we can respond and keep a record of the matter.
3.8 What we do not collect
We do not ask for or store payment card details, because the Service is free of charge and we operate no payment processor. We do not collect government identification documents, precise geolocation, biometric identifiers, or special categories of data as defined by the GDPR. Please do not send us any of these.
4.Information You Make Public
Upd is a public code forge, and much of what you do on it is public by design. The following are visible to anyone, including to people who are not registered and to search engines and automated crawlers:
- your username, profile page, avatar, and any profile fields you have not marked private;
- the content and full history of any repository, package, or organization you configure as public, including all commit metadata and the author and committer email addresses embedded in it;
- your issues, pull requests, comments, reviews, and releases in public repositories;
- your stars, watches, follows, and public activity feed, unless you have made your activity private;
- the fingerprints of the SSH and GPG keys you have added, which are exposed through the API as is conventional for Git forges.
Public means public, and it is durable. Content you publish may be cloned, forked, mirrored, indexed, archived, or scraped by third parties beyond our control, including by machine learning crawlers. Deleting it from the Service will not retract copies already taken. Consider carefully before you publish, and treat any secret that reaches a public repository as compromised and in need of rotation.
5.How We Use Information
We use personal information for the following purposes, and no others:
- To provide the Service. Authenticating you, serving Git operations and packages, rendering diffs and pages, delivering notifications and webhooks, and storing your content.
- To secure the Service. Detecting and preventing unauthorized access, credential abuse, spam, fraud, denial-of-service attacks, quota circumvention, and other conduct prohibited by the Terms of Service, and investigating incidents when they occur.
- To operate reliably. Monitoring availability and performance, diagnosing faults, planning capacity, and maintaining backups.
- To improve the Service. Understanding, in aggregate, which features are used and where the platform is slow or failing, so that we can make it faster and better.
- To communicate with you. Sending transactional messages such as email verification, password reset, security alerts, notification digests you have subscribed to, enforcement notices under the Terms of Service, and material changes to these documents.
- To enforce our Terms. Reviewing reports, assessing breaches, issuing notices, and applying the graduated enforcement measures described in the Terms of Service.
- To comply with law. Responding to valid legal process, meeting record-keeping obligations, and complying with export control and sanctions requirements.
We do not use your information for behavioural advertising, we do not sell it, and we do not disclose it to data brokers.
6.Legal Bases for Processing
Where the GDPR or equivalent legislation applies, we rely on the following legal bases:
- Performance of a contract (Article 6(1)(b)) for account creation and authentication, hosting and serving your content, delivering notifications, and providing support. Without this processing we cannot provide the Service.
- Legitimate interests (Article 6(1)(f)) for security, abuse prevention, fraud detection, service reliability monitoring, aggregate product analytics, and enforcement of our Terms. Our legitimate interest is in operating a secure, stable, and sustainable free platform; we have assessed that this processing is proportionate and does not override your rights.
- Consent (Article 6(1)(a)) where you choose to enable an optional integration, connect a third-party identity provider, enable federated avatars, or subscribe to non-essential communications. You may withdraw consent at any time, without affecting the lawfulness of prior processing.
- Legal obligation (Article 6(1)(c)) for responding to lawful requests, copyright takedown procedures, mandatory reporting obligations, and sanctions compliance.
8.Telemetry, Analytics, and Monitoring
We collect telemetry in order to improve the Service, and we use some third-party services to do it. We want to be direct about this rather than bury it. Our performance tracing is self-hosted and stays on our own network; our website analytics and uptime monitoring are provided by third parties. Each is described separately below.
8.1 Performance tracing and error reporting
The platform emits performance tracing and error telemetry through our own open-source tracing library. In substance this is function-level profiling and error logging. What it records is: the names of internal functions being executed, how long they took, whether they succeeded or failed, error messages and the source file and line numbers of the code that produced them, and static deployment attributes such as the service name, version, and cluster identifier.
It is worth being specific about what this telemetry does not contain, because it is narrower than the word «telemetry» usually implies. The library performs no instrumentation of web requests at all. It does not capture IP addresses, request or response bodies, HTTP headers, cookies, URLs, or query parameters. It has no mechanism to record the content of your repositories. Because all traffic reaches us through a reverse proxy, the application does not receive your originating IP address for these purposes in any event.
These traces are exported to a telemetry collector running inside our own private network, and are not transmitted to any third-party analytics vendor. The data does not leave our infrastructure. Its sole purpose is to find and fix what is slow or broken. It is not used to profile you, and it is never shared for marketing.
One honest qualification. Error messages and diagnostic tags are generated by the platform code, and an error message can incidentally embed a value that passed through the failing operation, such as a username or a repository path. We apply best effort within the platform to keep sensitive values out of error messages and diagnostic tags, but this is an engineering practice rather than a guarantee, and we do not claim it is perfect. Such data is retained only for the limited period described in Section 12 and is confined to our private network throughout.
8.2 Website analytics
Our marketing and landing pages use a privacy-oriented analytics service provided by our hosting platform to count page views and understand aggregate traffic patterns. It does not set advertising cookies and does not track you across other websites.
8.3 Uptime and availability monitoring
We use an external monitoring provider to probe the Service for availability, certificate validity, and performance, and to publish the results at status.upd.dev. This service monitors our endpoints; it does not observe individual users.
8.4 Infrastructure and edge logging
Our network, content delivery, and hosting providers maintain their own operational logs of requests reaching our infrastructure, as described in Section 3.6. These are used for security, abuse mitigation, and debugging.
8.5 What telemetry is not used for
Telemetry is not used to profile you commercially, to target advertising, to score or rank you, to train machine learning models on your content, or for any purpose other than operating and improving the Service. We do not enrich it with data purchased from third parties.
10.Service Providers and Subprocessors
We rely on a small number of infrastructure and operational providers. We engage them under contracts that restrict their use of personal information to the provision of their services to us, and we select them with regard to their security posture. The categories, and the principal providers within each, are:
- Network, security, and content delivery: Cloudflare — edge delivery, DDoS mitigation, TLS termination, and caching.
- Database infrastructure: PlanetScale — managed database clusters holding account and platform data.
- Compute and hosting: OVHcloud — servers hosting the application and Git storage across United States and European regions.
- Object storage: S3-compatible storage for attachments, avatars, Git LFS objects, packages, and repository archives, served in part through a public content delivery endpoint.
- Availability monitoring: Oh Dear — uptime probing and the public status page.
- Landing page hosting and analytics: Vercel — hosting and aggregate analytics for our marketing pages.
- Performance telemetry: none. Our tracing collector is self-hosted within our own private network, as described in Section 8.1, and is not a third-party service.
- Email delivery: an outbound mail provider for transactional messages such as verification, password reset, security alerts, and enforcement notices.
- Identity providers, at your election: GitHub, GitLab, and other providers you choose to authenticate with. These receive only the fact of an authentication request; they release profile data to us under their own terms.
- Avatar services, where enabled: federated avatar providers, which receive a hash of your email address in order to return an image. You may avoid this entirely by uploading a custom avatar.
- Community platforms: our Discord community is operated by Discord under its own privacy policy. Participation is voluntary and separate from your Account.
This list reflects our arrangements as at the effective date. We will update it as our providers change. If you would like the current list at any time, write to support@upd.dev.
11.International Data Transfers
Kompose operates from the United States and the Service is geo-distributed across infrastructure in the United States and Europe. Your personal information will therefore be processed in, and transferred between, the United States, the European Economic Area, and other jurisdictions in which our providers operate. Data protection law in these jurisdictions differs, and United States law may permit government access on terms different from those in your own country.
Where we transfer personal information out of the European Economic Area, the United Kingdom, or Switzerland, we rely on appropriate safeguards, principally the Standard Contractual Clauses approved by the European Commission and, where applicable, the UK International Data Transfer Addendum, together with supplementary technical measures including encryption in transit and at rest. You may request further information about these safeguards at support@upd.dev.
12.Data Retention
We keep personal information for as long as it is needed for the purposes described in this Policy, and then we delete it. In practice:
- Account and content data is retained for as long as your Account remains active, and is deleted when you delete your Account, subject to the qualifications below.
- Session and authorization tokens expire automatically. Sessions persist for up to ninety (90) days from last use, and are revoked immediately when you sign out or delete the token.
- Activity records are pruned on a rolling basis where they are no longer needed to render your feed or contribution history.
- Webhook delivery records are pruned automatically on a short cycle; they are diagnostic, not archival.
- Infrastructure and edge logs are retained by our providers for a limited period, typically measured in days to weeks, for security and debugging.
- Performance traces and error telemetry are retained on our private collector for a limited period sufficient to investigate incidents and performance regressions, and are aggregated or discarded thereafter.
- Backups are retained on a rolling schedule. Deleted data persists in backup media until those backups expire in the ordinary course, after which it is no longer recoverable.
- Moderation and abuse records, including records of enforcement action and preserved copies of reported content, are retained for as long as necessary to enforce our Terms, to prevent evasion of a termination, and to defend legal claims.
- Support correspondence is retained for as long as necessary to handle the matter and to maintain a record of it.
- Inactive accounts that have never been activated may be removed automatically. Dormant accounts holding published content are handled under the Terms of Service, with notice.
Two important qualifications. First, content you have published publicly may have been cloned, forked, or cached by third parties, and we cannot retrieve those copies. Second, where your content has been incorporated into another user's repository — through a fork, a pull request merged into their history, or a comment thread in their project — that content forms part of their record and is not removed when you delete your Account. Git commit metadata within another user's repository history is, in the nature of the technology, immutable.
13.Security
We implement technical and organizational measures appropriate to the risk, including: transport encryption for all connections; hashing of passwords with a modern memory-hard algorithm and per-user salts; hashing of access tokens and authorization validators at rest; support for two-factor authentication, WebAuthn, and passkeys; scoped access tokens; CSRF protection and hardened cookie attributes; strict tenant isolation and access control; least-privilege access to production systems by a small number of personnel; monitoring and alerting; and regular backups.
No system is perfectly secure, and we make no warranty that our measures will be sufficient in all circumstances. You are responsible for your own security hygiene: use a strong and unique password, enable two-factor authentication, scope your tokens narrowly, rotate them periodically, and never commit secrets to a repository.
If you believe you have found a vulnerability, please report it to support@upd.dev under the responsible disclosure terms set out in Section 10 of the Terms of Service. Please do not run scanners or exploits against production. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority and affected users as required by Applicable Law and without undue delay.
14.Your Rights
You have the following rights over your personal information. Many of them you can exercise yourself, immediately, through your account settings:
- Access. You may view and download your profile data, repositories, packages, issues, and comments through the interface and the API at any time.
- Rectification. You may correct your profile, email addresses, keys, and preferences directly in your account settings.
- Erasure. You may delete individual repositories, packages, and comments, and you may delete your entire Account, from your account settings. Deletion is irreversible and subject to the qualifications in Section 12.
- Portability. Your code is already portable: Git is distributed, and a full clone gives you the complete history. Issues, pull requests, and metadata can be exported through the API. If you would like assistance producing a structured export, write to us.
- Restriction and objection. You may object to or request restriction of processing carried out on the basis of our legitimate interests. Tell us which processing and why, and we will consider it.
- Withdrawal of consent. You may disconnect a third-party identity provider, disable an integration, or unsubscribe from non-essential email at any time.
- Non-discrimination. We will not degrade your access to the Service, or charge you differently, because you exercised a privacy right.
To exercise a right that you cannot exercise yourself, write to support@upd.dev. We will respond within thirty (30) days, or within forty-five (45) days where the request is complex, and will tell you if we need longer. We may need to verify your identity before acting, ordinarily by confirming control of the email address registered to the Account. We do not charge a fee for reasonable requests.
15.European Economic Area, United Kingdom, and Switzerland
If you are located in the European Economic Area, the United Kingdom, or Switzerland, you hold the rights set out in Articles 15 to 22 of the General Data Protection Regulation, or their equivalent under UK or Swiss law: the rights of access, rectification, erasure, restriction of processing, data portability, objection to processing, and the right not to be subject to a decision based solely on automated processing which produces legal or similarly significant effects. We do not carry out automated decision-making of that kind.
Our contact point for GDPR matters and for all data protection requests is support@upd.dev. Please put «GDPR Request» in the subject line and tell us which right you wish to exercise, so that we can route it quickly.
Kompose is established outside the European Union and has not appointed a representative under Article 27 of the GDPR. If a representative becomes required, we will appoint one and update this Policy accordingly.
You also have the right to lodge a complaint with your local supervisory authority. We would ask that you raise the matter with us first, because we would rather fix it than argue about it, but that request in no way limits your right to complain.
16.California Privacy Rights
If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives you rights over your personal information. Over the preceding twelve months we have collected the categories of personal information described in Section 3, namely identifiers such as name, username, email address, and IP address; internet and network activity information; and the content and account records you create. We collect it from you directly, from your device and browser, and from identity providers you choose to authenticate with. We use and disclose it for the purposes set out in Section 5 and to the categories of recipient set out in Sections 9 and 10.
Your rights are: to know what personal information we have collected, used, and disclosed, and the categories of source and recipient; to access a copy of it; to request correction of inaccurate information; to request deletion, subject to statutory exceptions; to limit the use of sensitive personal information, which we do not use for any purpose requiring such an option; and to be free from discrimination for exercising these rights.
We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined by the CCPA. We have not done so in the preceding twelve months, and we do not do so with the information of minors under sixteen.
To exercise a California privacy right, write to support@upd.dev. You may use an authorized agent, in which case we will require written proof of their authority and will verify your identity directly. California's «Shine the Light» law, Civil Code § 1798.83, permits residents to request information about disclosures to third parties for their direct marketing purposes; we make no such disclosures.
17.Children's Privacy
The Service is not directed to children under the age of thirteen (13), and we do not knowingly collect personal information from them. If we learn that we have collected personal information from a child under thirteen without verifiable parental consent, we will delete it promptly.
If you are a parent or guardian and believe that a child under thirteen has provided us with personal information, please write to support@upd.dev and we will act on it.
18.No Sale of Personal Information
To state it plainly and in one place, because it is the question most worth answering directly: Kompose does not sell your personal information, does not rent it, does not trade it, and does not disclose it to data brokers or advertising networks. We do not operate an advertising business. We do not monetize your attention. The Service is free of charge, and you are not the product being sold to fund it.
We do not use your content to train machine learning models. This applies to your repositories, packages, issues, comments, and communications, whether private or public, and we do not license or sell them to any third party for that purpose. We should be equally plain about the limit of that promise: content you have chosen to make public is, as described in Section 4, reachable by anyone on the internet, including by crawlers we neither operate nor control. Our commitment binds us. It cannot bind them.
19.Changes to This Policy
We may update this Policy to reflect changes in the Service, in our providers, or in the law. The date of the most recent revision appears at the head of this document.
Where a change materially affects how we handle your personal information, we will provide notice of at least thirty (30) days before it takes effect, by email to the address registered on your Account or by prominent notice within the Service. Your continued use of the Service after a change takes effect constitutes acceptance of the revised Policy. If you do not accept it, you may delete your Account.
20.Contact and Data Protection Requests
Kompose, a California stock corporation (entity number 6389732), operates the Upd.dev Service and is the controller of the personal information described in this Policy. Its registered address is 1401 21st St, Ste R, Sacramento, CA 95811, United States. For any privacy question, request, or complaint:
- Privacy, GDPR, and data protection requests: support@upd.dev (subject line: «GDPR Request»)
- California privacy requests: support@upd.dev (subject line: «CCPA Request»)
- Security and responsible disclosure: support@upd.dev
- General support and account matters: support@upd.dev
- Platform status: status.upd.dev
- Platform source code: /upd/upd-forgejo
We read every message that reaches that address. If something here is unclear, or if you think we have got something wrong, tell us and we will look at it properly.