Privacy Policy

Gitsu is operated by Coduo Studio LLC, a company incorporated in Delaware, United States. Gitsu is a desktop and web client for GitHub Projects v2 — a keyboard-first interface for managing issues and projects stored in your GitHub account.

Contact us at hello@coduo.co for any privacy-related questions.

GitHub remains the system of record for your issues and projects. Gitsu reads and edits those records through the GitHub API and does not maintain a separate issue database. This does not mean project data is processed only by GitHub: Gitsu caches responses on your device, its Web App uses a server proxy, AI suggestions send selected issue content to a third-party provider, Linear import relays attachments through our server, and AI tools you connect to Gitsu receive the board data they ask for, all as described below.

What We Do NOT Collect

• A separate, Gitsu-owned issue database. GitHub holds the authoritative issues and projects; Gitsu processes and caches their data to provide the Service.
• Passwords — authentication is handled entirely by GitHub OAuth
• Contact lists, address books, or files from your device
• Precise location data

Project data processing

The desktop app calls GitHub directly for board reads and edits. The Web App sends these requests through a Gitsu function, which attaches your authentication token and processes GitHub's response. It does not log request or response bodies; when a request fails, our hosting logs record the status, the operation name and the start of GitHub's error message. Both apps persist a local query cache; the desktop also keeps a board snapshot for MCP reads. Sign-out attempts to clear the query cache and desktop snapshot.

The desktop app also sends your GitHub token to Gitsu's server (dash.gitsu.app) when it checks your plan and when it checks for updates. The server uses the token only to confirm who you are with GitHub and look up your plan; it does not store the token.

For AI priority and milestone suggestions, Gitsu sends the issue title, a portion of its body, the available choices, and example issue titles with their assigned values through its API to our AI suggestion provider. An eligible issue can trigger this request when its detail panel opens, before a suggestion is accepted. This processing is separate from optional product analytics. Accepting a suggestion is a separate action that saves a field value to GitHub.

Linear import

If you import from Linear, you sign in to Linear and grant Gitsu read access. The Linear tokens are encrypted and stored in your browser, and your browser reads your Linear workspace directly from Linear; the tokens are never sent to Gitsu's servers. Imported issues, with their descriptions and comment history, are written to GitHub through the Web App's proxy described above. Linear images and attachments are downloaded by that proxy, because Linear does not let a browser download them, and uploaded to GitHub; the proxy does not keep a copy. We store the ID of each Linear issue you import and a running count against your account, to apply the free import allowance and avoid counting the same issue twice.

MCP and AI agents (desktop)

The desktop app includes an MCP server that lets AI agents on your computer, such as Claude Code or Claude Desktop, read and edit your boards. Each time it starts, the desktop app adds this server to the configuration file of every supported agent it finds (for example ~/.claude.json), unless you have turned that agent off in Settings. The MCP server reads your GitHub token from your system keychain and calls GitHub directly. Board data it returns goes to the agent that asked for it, and from there to that agent's own AI provider under your agreement with them; Gitsu does not receive it. The desktop app also contacts public MCP registries when you browse for MCP servers, and downloads agent tools from their publishers when you install them.

Ask AI and your own AI key

Ask on the Web App answers questions about your board with an AI provider you choose (Anthropic, OpenAI, Google or OpenRouter), using an API key you supply. To answer, it sends your question together with the board content it needs, such as issue titles, fields and text, to that provider, which handles it under its own terms. Your key is encrypted and stored in your browser, on your device. It is sent only to the provider you chose, directly from your browser, and never to Gitsu's servers. Gitsu pays for no model call: each call is billed by your provider to your key. Forget key in Settings deletes the key from your browser; you can also revoke it with your provider. A browser extension you install can read any web page, including Gitsu's, so we suggest a key with a spending limit.

Authentication Data

When you sign in with GitHub OAuth, Gitsu asks GitHub for these permissions:

• repo — read and write access to your public and private repositories, so Gitsu can read and edit their issues.
• project — read and write access to your GitHub Projects.
• read:org — read your organization memberships, so Gitsu can find your organizations' Projects.
• read:user — read your profile: username, numeric ID, name, avatar and public email, if you show one.

You can review or revoke this access at any time in GitHub under Settings, Applications. On the Web App, your GitHub token is encrypted inside the session cookie described in section 5; on the desktop, it is kept in your system keychain. We do not store it in our database. Our database keeps your numeric GitHub ID, and, if you manage a Team's Seats, your GitHub username and name, which appear in Billing and Team views. We use this information to authenticate you, run billing and Seats, and provide the Service.

Team Seats

If you buy a Team, you reserve Seats for teammates by GitHub username. For each Seat we store the holder's numeric GitHub ID, username, public email if their profile shows one, and avatar URL, so the buyer can see who holds each Seat. Records of Seats that have ended are kept as part of the subscription's billing history. If the buyer sends an invitation by email, the address they enter is passed to our email delivery provider to deliver it; we do not store the address. If you have been invited and want your details removed, contact us.

Payment Data

Purchases are sold through our payment provider, which acts as merchant of record. It takes the payment, works out tax and sends your receipts under its own privacy policy. We do not store your credit card number or bank details. Our payment provider gives us limited information such as the last four digits of your card, card brand, and billing country for record-keeping purposes.

Analytics Data

We use an analytics provider to measure how Gitsu is found and used, and to find errors. There are three analytics streams and one error-report stream, described below. All four are sent to our analytics provider’s EU region only.

We count visits without cookies. After you sign in, we record how you use Gitsu to improve it.

Website analytics

On this website, analytics is cookieless. It sets no cookies and stores nothing in your browser, and does not identify you or track you across sites. Our analytics provider groups one day’s visit under a code it derives from a salted hash that it discards daily. We record which page was viewed, which call-to-action was selected, the deployment environment and site release, any campaign parameters in the link you followed, and whether you arrived from an AI assistant’s answer (ChatGPT, Claude, Perplexity and similar). IP addresses and geo-IP lookups are discarded on collection.

The campaign parameters and the name of the site that sent you (for example threads.com, never the full address) are added to the links between pages of this site and to the Sign up and Open app links. If you create an account, we save them on it once, so we know what first brought you to Gitsu.

Campaign parameters are the utm_ values a marketing link can carry. We record them exactly as they appear in the link, because the raw value is what makes the measurement useful. We drop any campaign value that contains an email address, but we cannot reliably detect every kind of personal detail somebody might place in a link. If you follow a link whose campaign parameters contain personal information, that text is stored with the event as written. Removing the utm_ parameters from a link before opening it avoids this.

Conversion milestones

We record ten steps in signing up and paying as they happen:

• sign-in started, and sign-in failed (with an error code)
• signup completed
• first Project opened in Gitsu
• a paywall shown (with the reason)
• a Checkout created, and a return from Checkout that was not yet confirmed (with the outcome)
• a subscription became active, and a first paid conversion
• the Gitsu plugin for Claude installed

Some are sent by our servers and some by the apps. Steps before sign-in carry a fresh random identifier. Steps after sign-in carry your Gitsu account’s random internal id, so one account is one person in our analytics, shown under a generated nickname such as “calm-dogs-jump” with the source that first brought you in. Each step carries only which app it came from (desktop or web), the reason or outcome shown above, campaign context, and commercial detail such as plan, billing interval and currency. Your GitHub identity, email, name, payment-provider identifiers, IP address, user agent and request payload are refused by name and can never be attached. So that each step is counted once per account, our database notes which of these steps your account has already reached; that note is never sent to our analytics provider. This measurement is part of operating the Service and is not optional.

Product analytics (optional; off by default in the EEA, UK and Switzerland)

The Gitsu desktop and web apps can send a small set of usage events so we can see which features are used and how large the Projects people work with are. In the EEA, the UK and Switzerland this is off unless you turn it on. Elsewhere it is on unless you untick it. Nothing is sent until your answer is saved at the end of first-run setup, and the app re-checks that answer before every single event.

You are asked once during first-run setup. The box starts unticked if you appear to be in the EEA, the UK or Switzerland, and ticked elsewhere. We decide this from the country our hosting provider derives from your IP address for that request, falling back to your device’s time zone; neither the country nor the time zone is stored or sent with any event. Whatever you leave ticked when you finish setup is what we save. You can turn it on or off at any time inside Gitsu under Settings, in the Privacy pane, using the Share product analytics switch. Turning it off silences the very next event. It does not delete events already sent.

When it is on, the apps send event names drawn from a fixed list, carrying only approved fields: which app you are using, which feature you used, the kind of view, an outcome, a sanitized error category, and integer counts and durations. Two allowlists enforce this in code, one for event names and one for field names, and an event carrying anything outside them is discarded whole rather than trimmed. Your issue titles, bodies, comments, labels, Project and repository names, search text, URLs, usernames and tokens are not approved fields and cannot be sent. There is no autocapture and no session recording. These events carry the same account id and nickname as the conversion milestones above.

Error reports

When something breaks, the desktop app, the Web App, this website and our servers send an error report to our analytics provider’s EU region so we can fix it. This happens whatever your product analytics choice, because it is how we keep the Service working. A report carries the error message and stack trace, which app and version it came from, and, for the desktop app, the details of a crash. Before a report leaves the browser or app, it is scrubbed: tokens, keys, email addresses and other secret- or personal-looking text are replaced with placeholders. Reports set no cookie, are not linked to your account, and use an identifier that lasts only until you close the app or page. There is no session recording.

Your Analytics Choice

We store your answer so the desktop and web apps read the same setting: whether product analytics is on, which version of this notice you saw when you decided, and when you decided. It is held in our database against your numeric GitHub account id and is never sent to our analytics provider. If the notice changes materially, we ask you again rather than carrying an old answer forward.

• Provide the Service — authenticate you and connect to your GitHub account.
• Process payments — manage Pro and Team subscriptions and Seats through our payment provider.
• Improve the product — analyze usage, per account after sign-in, to guide development. Website analytics and conversion milestones run on all traffic; product analytics in the apps runs only if you turn it on.
• Fix errors — use scrubbed error reports to find and fix faults.
• Communicate — respond to support requests, send essential service notices, and deliver the Team invitations a buyer asks us to send.
• Legal compliance — meet our obligations under applicable law.

We do not sell your personal information. We do not use your data for advertising.

Our website analytics is cookieless — it sets no analytics or advertising cookies and does no cross-site tracking, so there is nothing to opt out of in your browser settings.

Browser storage

Gitsu also saves some things in your browser's own storage. They stay on your device until you sign out, clear them or clear your browser's data:

• This website saves your light or dark theme choice in local storage, only if you use the theme switch.
• The Web App saves your active Project, settings, theme, unsent comment drafts and the progress of a Linear import in local storage; the query cache described in section 3; your AI key and Linear tokens, encrypted, in IndexedDB; and, during sign-in only, sign-in state in session storage.

• Project data — GitHub holds the authoritative records under its retention policies. Gitsu rejects query-cache snapshots last saved more than 24 hours ago; this is not a guarantee that every cached file is erased after 24 hours. Sign-out attempts to remove the local query cache and desktop MCP snapshot.
• AI request content — Our AI suggestion provider processes the selected content described in section 3. Its privacy policy says inputs are not used to train or fine-tune models and describes its retention practices. We do not promise immediate deletion of every request by that provider.
• Account data — your numeric GitHub ID, and your username and name where we hold them, are retained while your account exists. There is no self-service account deletion: email us using the contact route in section 8 and we will delete these records, except payment records the law requires us to keep.
• Seat records — kept with the subscription's billing history, including Seats that have ended. A Seat holder or invitee can ask us to remove their details.
• Linear import records — the IDs of the Linear issues you imported and your import count, kept while your account exists.
• Session cookie — expires after 14 days, or when you sign out.
• Server logs — kept by our hosting provider under its standard log retention.
• Payment records — retained as required by tax and accounting law (typically 7 years).
• Analytics data and error reports — website analytics, conversion milestones, product analytics and error reports are retained by our analytics provider under its standard retention policy. Website visits, events before sign-in and error reports carry no identifier that lasts, so we cannot look up, export or delete them for one visitor. Events after sign-in carry your account’s internal id; when you ask us to delete your account, we delete those events too.
• Your analytics choice — one record per account, retained for as long as the account exists. There is no self-service control that deletes it; ask us using the contact route in section 8 and we will remove it.

GDPR (EEA/UK)

If you are in the European Economic Area or the United Kingdom, you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate data
• Request erasure of your data
• Restrict processing of your data
• Data portability — receive your data in a structured format
• Object to processing based on legitimate interest
• Lodge a complaint with your local data protection authority

Our legal bases for processing are:

• Contract performance — authenticating you, connecting to your GitHub account, managing your subscription and Seats, Linear import, and the AI suggestions and Ask features you use.
• Consent — optional product analytics in the desktop and web apps. In the EEA, the UK and Switzerland nothing is sent unless you opt in; elsewhere the setup box starts ticked and you can untick it to opt out. You may withdraw at any time in Settings under Privacy, and we ask again rather than carry an old answer forward when this notice changes materially. Withdrawal stops future events; it does not undo processing that already happened.
• Legitimate interest — cookieless website analytics and conversion milestones, used to understand how Gitsu is found and whether signup and checkout work; scrubbed error reports, used to find and fix faults; and showing a Team buyer who holds each Seat. We also rely on this basis to record and honour your product analytics choice.
• Legal obligation — tax and accounting records.

CCPA (California)

If you are a California resident, you have the right to:

• Know what personal information we collect and how it is used
• Request deletion of your personal information
• Request correction of inaccurate information
• Opt out of the sale or sharing of personal information

Gitsu does not sell or share personal information as defined by the CCPA.

How to Exercise Your Rights

Contact us at hello@coduo.co. We aim to respond within 30 days. We may ask you to verify your identity before processing your request. This includes deleting your account: there is no self-service deletion, so email us and we will delete the records described in section 7.

Your data may be processed in the United States and the European Union. Analytics is a specific exception: all three analytics streams described in section 3 are sent to our analytics provider’s EU region and nowhere else. Each of the three refuses any destination other than the single allowlisted EU ingestion host, and drops the event rather than sending it elsewhere, so analytics data does not reach the United States. Error reports are also sent to our analytics provider’s EU region. Where other data is transferred outside the EEA, we rely on Standard Contractual Clauses or other appropriate safeguards to ensure an adequate level of protection.

Gitsu is not directed to anyone under the age of 16. We do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal data, contact us at hello@coduo.co and we will delete it promptly.

We take reasonable measures to protect your information:

• All connections to Gitsu use TLS/HTTPS encryption in transit.
• Authentication is delegated to GitHub OAuth — we do not store passwords.
• Payment processing is handled entirely by our payment provider — we do not store card details.
• Analytics data is hosted on our analytics provider’s EU infrastructure.

In the unlikely event of a data breach affecting your personal information, we will notify affected users and relevant authorities as required by applicable law.

We may update this Privacy Policy from time to time. Material changes will be posted with a new “Last updated” date at the top of this page. We encourage you to review this page periodically.

For privacy-related questions, data requests, or concerns, contact us at hello@coduo.co. We aim to respond within 30 days.

See also our Terms of Service.