Privacy

This page describes how the GearOps site handles data. It is not legal advice. Questions go to [email protected].

An uploaded Slack or GitHub export is processed on this server to build a preview and, after payment, a download. It is deleted after 24 hours, or sooner if you press “Delete this file now”. It is not read by a person. It is not used to train a model. The database stores counts and problem totals, not the messages.

The private result link is a random token stored in an HttpOnly cookie and, once, in the address fragment so you can reopen the page. The fragment is not sent to the server by the browser. Paying requires a GitHub sign-in. Dodo Payments collects the email address for the receipt and stores the card. GearOps stores a Dodo customer id, not the card number.

Pasted Dockerfiles, workflows, logs, and Compose files are processed in memory to produce a result. They are not written to the application log. They are not written to the database unless you have a day pass or Pro and you tick “Save this run”.

The usage ledger stores a tool name, a timestamp, and HMAC hashes of a cookie, an IP prefix, or a GitHub account id. Raw IP addresses are not stored. The hash secret is separate from the cookie signing keys.

GitHub login uses OAuth. GearOps stores the name, profile image, and email GitHub shares, so a purchase can be opened on another device. Access tokens are not kept. Dodo subscriptions store an id, status, and period end on your user id. Older $5 Razorpay subscriptions, if any, stay recorded the same way.

If an AI provider is configured, the pasted text is sent to that provider for the rewrite or explanation. The default Cursor slot does not send anything, because Cursor does not offer a prompt API that fits this use. An OpenAI-compatible provider does receive the text for that request.

The cron tool may send a browser fingerprint, and only when you click Run. It is combined with network data when an ASN table is installed. It is stored as a hash.

To ask for deletion of an account or opt-in history, write to the address published on the site you deployed. History rows and the auth user can be deleted. Hashed usage claims are not reversible to a person, but they can be deleted by account id where one exists.