Privacy

Student awards

For a student Pro award, we use academic-email evidence from ordinary email OTP or verified provider sign-in. We store the institution, matched domain, eligibility-source revision, fixed award dates and hashed redemption keys. Redemption records are retained after expiry and account deletion so the same academic identity cannot reset the one-time offer. We do not request student enrollment documents in this flow.

Cancellation and refunds

To get a refund, first cancel the subscription in your account, then request the refund in the same account. A refund can be requested only before 24 hours have passed after successful payment, and only by the account that paid (for an organization, an owner or administrator). This window also applies when the purchased period is scheduled to begin after a trial. After 24 hours, a new refund request is unavailable; cancelling then does not refund the payment, and access continues until the paid period ends.

Eligible refunds return the full amount paid, with no percentage, processing fee or other deduction, to the same card or wallet and in the currency charged. Refunds take 5 to 7 business days from submission of the eligible request. GitTree support processes them manually through Paymob and confirms the result in your account and by e-mail. A confirmed full refund ends the purchased period or removes the added organization seats. Resuming the subscription before the refund is confirmed withdraws the request. Any mandatory legal rights remain unaffected.

We retain the request time, reason, payment reference, amount, currency and reviewed outcome for support and accounting. If you delete your account, these records stay under your account’s identifier.

The GitTree app

Desktop analytics starts automatically after a one-time notice and can be disabled in Settings using Share usage analytics. Disabling it stops recording and resets its identifier; it does not erase previously collected data. Desktop identifiers use local storage. Separately, anonymous command counts continue under the existing usage-reporting system. The backend records account lifecycle facts such as registration, support requests and account retirement. Account deletion is a soft delete.

Drafting a commit message or pull request description with AI is optional. Only when you click Generate does GitTree run the coding-agent tool you chose (such as Claude Code, Codex, Gemini CLI or the Antigravity CLI) on your computer and give it the staged changes, or the pull request’s commits, to write from. That tool and its provider handle them under their own terms. GitTree itself sends nothing to an AI service and stores no AI key.

Uninstall survey

When you uninstall the app with the Windows installer, or with Uninstall GitTree in About, it first shows a short, optional survey in a small GitTree window; removing the Linux .deb package with apt prints the address of the same survey on this website instead. Nothing is sent unless you choose to send it: skipping sends nothing, and neither the window nor the page starts any analytics. Your answers (why you left, how long you used GitTree, what you use instead, your comment, the app version and the language) are stored without your account, IP address or device, so we cannot link them to you. Please keep personal details out of the comment.

Repo Insights and Team reports

Repo Insights (GitTree Pro) counts commits, changed lines and files, and active days per author from a repository’s history, on your computer, with your own git. The report is kept on your computer only; nothing is uploaded when you run one.

A Team report leaves your computer only when you share it yourself: you pick an organization you own or administer, see exactly what will be sent, and press Upload Report. It holds counts only, never code, diffs, file contents, commit messages or branch names; folder names only at the detail level that says so. Members are matched to the organization on your computer, and the key used for that is never stored. The organization’s owners and admins see every member’s row; each member sees their own row and the team totals, and can see what is shared about them and who opened the member breakdown. Reports are stored for the organization in GitTree’s Firestore database for the retention the owner chose (90 to 730 days), and can be deleted by the owner or the admin who uploaded them. Owners and admins turn Team reports on in the organization’s report settings on this website.

Pull request counts are read, only if you include them, from your own connected GitHub or GitLab account on your computer. Nour, the AI assistant, can never run, share or upload a report; it reads a kept report’s numbers only after you approve that read, and then they go to the agent tool you chose, under its terms.

Credentials

Connecting a GitHub, GitLab, Bitbucket or Azure DevOps account in the app is optional. Tokens, passwords and passphrases are stored only in your operating system’s keychain — the macOS Keychain, the Windows Credential Manager or, on Linux, the system keyring through the freedesktop Secret Service (GNOME Keyring or KeePassXC) — and are sent only to the provider they belong to. On Linux, if no Secret Service is running or it is locked, the app tells you what to install or unlock and keeps nothing: no token, no sign-in session and no plaintext file.

Your GitTree account

You create your account on this website by signing in with a provider account (GitHub, GitLab, Bitbucket or Azure DevOps) or with your email address.

Each provider is asked only for what identifies you: GitHub for your public profile and your email addresses (the read:user and user:email permissions); GitLab for your profile, including its email address (read_user); Bitbucket for your account and its email addresses (account and email); and Azure DevOps, through Microsoft Entra ID with a work or school account, for your basic sign-in profile and your Azure DevOps profile (openid and Azure DevOps’ vso.profile), which is read only to confirm that you have an Azure DevOps account. An email address counts only when the provider has confirmed it, so the one Microsoft reports for an Azure DevOps sign-in is not used.

Signing in with your email address needs no password: we email a six-digit one-time code to the address you enter, it works once and for ten minutes, we keep only a hash of it, and the address you enter becomes your account’s email. GitTree’s servers complete that sign-in with the provider themselves; the website and the app only ever receive a GitTree session, and the GitTree service never keeps a provider access token. Connecting a GitHub or Bitbucket account for repositories and pull requests in the desktop app is a separate, optional step; its token is stored only in your computer’s keychain.

For each account we store: your display name, username, primary verified email address and avatar URL; the provider you signed up with; whether you use GitTree as an individual or an organization; when the account was created, when you last signed in and how many times you have signed in; and, when you sign in from the desktop app, the app version and operating system you last used.

Each time you sign up or sign in, we also record where it came from: the country, whether it was this website or the desktop app, and for the desktop app its operating system and version. We keep the country you signed up from and the one you last signed in from with your account, and a history of your sign-ins (the same facts, the provider you used on the website and the time of each) for 90 days. The country is worked out on GitTree’s own servers from your IP address, using a public-domain IP-to-country database (ip-location-db) that runs on those servers; your raw IP address is not stored or shared.

For each provider account linked to your GitTree account we store the provider, your user id and username there, your email address and avatar URL, when it was linked and when you last signed in with it. For an Azure DevOps account the user id is your Microsoft directory (tenant) id and object id, the username is your display name, and no email address or avatar is stored. For an email sign-in the user id is your email address in lower case, the username is the part before the @, and no avatar is stored.

The desktop app signs in through this website: once you confirm, the site hands the app a one-time code that works once and expires after five minutes. Such codes, and the tickets that finish a new sign-up, are short-lived, and we store only a one-way hash of them.

If you create or join organizations, we store each organization’s name and address, its members and their roles, and when each member joined. Other members of an organization can see your username, name, avatar and role in it.

Invitations are stored with the organization, the role offered, the invited GitHub username or email address, who sent it, when it expires and how often it has been used. GitTree does not email invitations: the invited person finds them in their dashboard or opens the link you share. Invitation links carry a secret token; we store only a one-way hash of it.

This data lives in Google Cloud Firestore and Firebase Authentication in the GitTree Firebase project. Only GitTree’s own servers read it; the website and the app never access the database directly. We do not sell it or share it with any advertising service.

Plans and device records

GitTree is free for everyone right now: Pro and organization seats carry a 100% discount, GitTree takes no payments, and we ask for no payment or billing details. We store the plan each account and organization is on and the discount it uses. Trial, subscription, discount, seat and billing records created before this change stay with the account.

So that hosting integrations work without a GitTree account, and for older versions of the app that count Pro trials, the desktop app may tell GitTree’s servers about the computer it runs on: a securely stored installation ID, the platform, the operating system version, the processor architecture, the app version and one hardware identifier that the app turns into a protected hash on your computer before sending it. The server keeps these values with a server-assigned device ID and the first and last time the device was seen; it does not keep your IP address or country with the device record. Older versions of the app also send the device name and model, processor, memory, locale, time zone and hashed network addresses; the server checks them and discards them.

GitTree’s administrators can see individual device records. Signed-in use links your account to its devices; one account can use several devices and a shared device can have several accounts. We collect no files, repository content, passwords, tokens or browsing history as device inventory. A device’s details are deleted after 90 days without use.

Deleting your account

You can delete your account at any time from your dashboard on this website (Account settings). Deletion closes the account: your Firebase sign-in record is removed, so you can no longer sign in to it; you leave your organizations; personal billing subscriptions end; and your provider accounts are unlinked, so each can register later as a new, separate GitTree account. Deletion does not erase your data. We keep your profile, sign-in history, the provider accounts you used, your organization roles, support tickets, review and first-visit record, and your payments, billing documents, refund requests, device links and trial records, all under your account’s identifier. The website and the app no longer use or show them, and only GitTree’s administrators can see them. They have no set deletion date, except sign-in history, which expires after 90 days, and device details, which are deleted after 90 days without use. Your trial records keep applying, so signing up again does not give you a new trial.

If you are the last owner of an organization, make another member an owner or delete the organization first, so that no organization is left without an owner.

This website

This website sets a functional cookie that remembers your language. It contains no personal data.

The site also keeps how your browser first reached it in its own cookie (gt_first_open), for up to 400 days. It does this for every visitor, whether you accept, decline or ignore the analytics notice. The cookie holds a random identifier, the time of your first visit, the first page you saw with its campaign tags (such as utm_source), the address of the site that sent you without its query, and the name of the ad network if you came from an ad, never the ad’s click identifier. When you click a download link, the site’s server sends our analytics service the platform, the campaign tags, the host name of the site that sent you and the ad network, with your browser’s user agent and IP address so robots can be left out and a country worked out, under a new random identifier each time, so the click is not linked to you. If you create a GitTree account, the whole record is sent to GitTree’s servers and stored with your account, accounts created from the same browser are linked through its identifier, and the record stays with us if you delete your account. We use it only to learn which sources bring people to GitTree, and we do not share the record itself with any analytics service or tracker. You can delete the cookie in your browser at any time.

If you sign in, Firebase Authentication keeps your session in this browser’s storage, and the site keeps a small flag in local storage so the header can show your account menu. Signing out removes both. While a sign-in is in progress, its one-time values stay in this tab’s session storage until you return from the provider.

The site uses PostHog, a product-analytics service hosted in the United States, for analytics and metrics: page views, clicks, downloads, traffic sources, performance and errors. It starts when a page has loaded, unless you choose Decline in the cookie notice. It stores its own identifier in a cookie and in local storage, records session replays in which everything you type is masked, and, when you are signed in, links that activity to your account (account ID, email address, display name and plan). If the GitTree desktop app opened the page, the app’s device identifier (a hash) is attached. If you choose Decline, its cookie and identifier are removed and it counts public pages only, without cookies, recordings or any link to an account or device, using an anonymous identifier that changes every day. Pages that carry a sign-in code or an invitation token are never measured. To see the notice again, clear this site’s data in your browser.

We use no advertising trackers. Our hosting provider, Firebase App Hosting on Google Cloud, may keep standard server logs, such as IP addresses and requested pages, for security and reliability.

The home page shows reviews from people who rated GitTree five stars in the app: the reviewer’s display name, profile picture and organization name, and the message they wrote. Submitting a new review from the app replaces the old one, and deleting your account on the dashboard hides it from the site; we keep a copy that is not shown. The website keeps a short-lived copy of the list, so a change reaches the page within about 15 minutes, occasionally longer.

Profile pictures are loaded directly from the sign-in provider’s image host (GitHub’s, for example), not through our servers, so that host receives your browser’s IP address when the page shows them, as with any image. This does not depend on the analytics notice.

Download links take you to GitHub, whose own privacy policy applies there. The Linux installers (.deb and AppImage) are unsigned; the SHA256SUMS.txt published with each release is how you check a download.

Contact

Questions about privacy? Write to us from the Support page or by e-mail.