Privacy

Privacy Policy

This page explains what information Code Tweet handles, why it is used, what is sent to external services, and how to delete it.
Last updated: June 27, 2026

1. Information we collect

Code Tweet handles: the email address from your GitHub sign-in, GitHub account identifiers, the connection details needed to fetch your GitHub README and repository list, your generation count, plan determination, usage logs, and a hashed form of your IP address when you use the service as a guest. From GitHub we retrieve only README files and repository listing information (name, description, public/private status, updated time, and the like) — we never retrieve, view, or store source code. We also handle the project description, README, extra prompt, URL, and hashtags you enter when generating posts. For credit purchasers and subscribers, the generation history we store consists of the generated posts, suggested posting times, URLs, hashtags, and generation timestamps; the README body and extra prompt body are not stored. Generation history is kept to the 50 most recent entries per user, and older entries beyond that are deleted automatically when new ones are added.

2. Purposes of use

We use the information we collect to verify your sign-in status, enforce usage limits, determine your plan, fetch your GitHub README and repository list, generate posts with AI, prevent abuse, respond to enquiries, and improve the service.

3. Handling of GitHub tokens

We use a GitHub App to fetch READMEs from private repositories. The granted permission is limited to Contents: Read-only, which GitHub enforces. This service does not store per-user access tokens. When a README needs to be fetched, the server issues a single-use access token that expires automatically after about an hour, and discards it after use. The only thing kept in the database is the installation identifier (a number), which on its own cannot access any repository. You can revoke the connection at any time from GitHub under Settings → Applications → Installed GitHub Apps.

4. Information sent for AI generation

When posts are generated, the project description, README, extra prompt, URL, hashtags, and similar input you provide are sent to the Google Gemini API. Do not include private keys, access tokens, passwords, third parties' personal information, or unpublished confidential information in your README or prompts.

5. External services

This service uses Supabase for authentication and its database, GitHub for sign-in and repository information, the Google Gemini API for post generation, Vercel for hosting, runtime, and usage analytics (Vercel Analytics / Vercel Speed Insights), Google Analytics provided by Google LLC for access analysis, and Microsoft Clarity for UX improvement via heatmaps and session recordings. How each external service handles information is governed by its own privacy policy and terms of service.

6. Analytics and session recording

We use the following analytics tools to improve the service and detect faults. Vercel Analytics uses no cookies and collects anonymous page views, referrers, region, and device information. Vercel Speed Insights collects performance metrics such as LCP, CLS, and INP. Google Analytics uses cookies to measure access patterns including page views, referrers, region, and device information (IP addresses are anonymized by Google). If you wish to opt out of measurement by Google Analytics, you can use Google's "Google Analytics Opt-out Browser Add-on" (https://tools.google.com/dlpage/gaoptout). Microsoft Clarity uses cookies for heatmaps and session recordings, capturing on-page interactions (clicks, scrolling, mouse movement) in anonymized form. Password fields, credit card details, and other sensitive input fields are masked automatically and are never recorded in plain text.

7. Deleting your information

Signed-in users can delete their account from the settings page. Deletion removes information tied to you, including your account, GitHub connection details, usage history, generation history, and plan information. Some logs or information may nonetheless remain for a period of time due to legal compliance, abuse prevention, incident investigation, or the retention behaviour of external services.

8. Security management

Secrets such as API keys, the GitHub App private key, and the Service Role Key are managed as server-side environment variables and are never exposed to the client. IP addresses from guest usage are stored in hashed form. Access to private repositories uses short-lived GitHub App tokens, and no per-user access tokens are stored. Access rights are controlled based on authentication state and user ID.

9. Contact

For enquiries about the handling, deletion, correction, or suspension of use of personal information, please contact us through the contact page. Where identity verification is required, we will respond after confirming your sign-in status and registered details.

10. Changes to this policy

This policy may be updated as the service or the external services it uses change. Significant changes will be announced within the service.

11. Published source code (for verification)

The code this service uses to communicate with GitHub (fetching READMEs and repository listings) is published so that third parties can verify it. The only GitHub APIs called are those for fetching a README and listing repositories; no API that retrieves source code is used.

Review the GitHub communication code (on GitHub)