Privacy Policy
This explains what personal data Atomira processes, why, and what you can do about it. It is written to meet Articles 13 and 14 of the General Data Protection Regulation, and to be readable, which we do not think are in conflict.
The short version
- No tracking. No analytics product, no advertising network, no third-party cookies, no tracking pixels. We do not record anything at all about signed-out visitors beyond ordinary server logs.
- Nothing is sold or shared for marketing. Your data is not sold, rented, or handed to advertisers or data brokers.
- Your code is not training data. We do not use your repositories to train machine learning models, and we do not give them to anyone else to do so.
- Hosted in the EU. The server and the database are in the European Union — Germany and the EU respectively. The one exception is our identity provider, which holds your account name and email in Switzerland; see who else handles your data.
Who is responsible
The data controller is Atomira Labs. It is not a registered company yet — while Atomira is in early access the controller is the individual operating under that name, and a registered entity and address will be named here before early access ends. You can ask us for those details at any time using the address below.
For anything in this policy, including to exercise your rights, contact hello@atomiralabs.com.
What we process, and why
| Data | Purpose | Legal basis | Kept for |
|---|---|---|---|
| Account identity — email address, name, and the user ID issued by our identity provider | To create your account, sign you in, and contact you about the service | Performance of a contract | Until you delete your account |
| Profile — handle, avatar image, biography, and the profile details and links you choose to add | To render your public profile | Performance of a contract | Until you delete it, or delete your account |
| Repository content — your files, and the git metadata inside commits, which includes the author name and email address recorded by your git client | To store and serve your repositories, which is the service itself | Performance of a contract | Until you delete the repository or your account |
| Personal access tokens — stored only as a hash, alongside a name, prefix, scope, and last-used timestamp | To authenticate git operations without storing the token itself | Performance of a contract | Until you revoke the token or delete your account |
| SSH public keys — the public key, its fingerprint, and the title you give it | To verify that an SSH-signed commit was signed by a key registered to your account | Performance of a contract | Until you delete the key or your account |
| Activity — the contribution events shown on your profile timeline and calendar | To show your activity to you, and publicly where you have made it public | Performance of a contract | Until you delete your account |
| Waitlist requests — email address, name, and the free-text reason you give | To review and decide on access requests, and to send you an invitation | Consent, which you may withdraw at any time | Up to 12 months after the decision, then deleted |
| Safety records — reports and blocks you make or that concern you, and their stated reason | To act on reports and to keep blocks in force | Legitimate interest in a safe service | Up to 24 months after the report is closed |
| Profile views — a per-day count of signed-in users who viewed your profile, keyed by an irreversible hash so the record cannot be traced back to a person | To show you the visitor count on your own profile | Legitimate interest | Rolling, deleted with the profile |
| Server and security logs — IP address, timestamp, and request details generated by the web server | To keep the service running, investigate faults, and detect abuse | Legitimate interest in security and availability | Short-term, no longer than 30 days |
Email addresses inside git commits
This one deserves stating plainly, because it surprises people and because we cannot fix it for you after the fact.
Commit metadata cannot be taken back
Every git commit permanently records the author name and email address configured in your git client, and that information is part of what the commit hash is calculated from. It cannot be edited afterwards without rewriting history and changing every commit identifier that follows it. It is also copied into every clone and fork — so once someone has cloned your repository, that copy is outside our reach entirely.
If you would rather not publish your real address, set a dedicated one before you commit:
git config --global user.email "you@example.com"We use commit metadata only to attribute commits and build your contribution timeline. We never use it to send you email.
Who else handles your data
We use a small number of providers to run the service. They process data only on our instructions.
| Provider | Purpose | Location |
|---|---|---|
| OVHcloud | Application hosting — the server Atomira runs on | Germany |
| Turso | Database — profiles, repositories, git objects, waitlist | European Union |
| ZITADEL Cloud | Identity provider — sign-in, credentials, account name and email | Switzerland * |
Outside the European Economic Area. Switzerland is covered by a European Commission adequacy decision, which means the Commission has found its data protection law to offer protection equivalent to the GDPR — so no additional transfer safeguard is required, and your rights under this policy are unaffected.
We may also disclose data where the law requires it — for example in response to a valid order from a court or competent authority. We will tell you if that happens, unless we are legally prohibited from doing so.
Deleting your account
You can delete your account from your settings. When you do, we delete your profile and avatar, your repositories and their git objects, your access tokens and SSH public keys, your contribution history, and your waitlist entry. Your identity record with our identity provider is deleted too. We do not keep a shadow copy, and we do not retain your commits under an anonymised name.
What deletion cannot reach
Git is designed so that every clone is a complete copy. If someone has forked your public repository or cloned it to their machine, that copy is theirs and continues to exist — including the commit metadata in it. We can delete what is on our servers; we cannot recall copies already made. Anything you publish publicly should be published on that understanding.
Limited records may survive deletion where we are required to keep them — for example a block or a closed safety report needed to protect another user, which we keep in the most minimal form that still works.
Your rights
Under the GDPR you can ask us to give you a copy of your data, to correct it, to delete it, to restrict or stop a particular use, or to provide it in a portable format. Where we rely on legitimate interest, you can object, and we will stop unless we have compelling grounds not to. Where we rely on consent, you can withdraw it at any time without affecting what we did before you withdrew it.
Write to hello@atomiralabs.com and we will respond within one month. There is no charge. You do not have to explain why.
If you think we have handled your data badly, you can complain to a supervisory authority. Ours is the Slovenian Information Commissioner (Informacijski pooblaščenec), and you may also complain to the data protection authority in your own country of residence or work. We would rather you told us first, but you are not obliged to.
Security
Traffic is encrypted in transit. Session cookies are encrypted and not readable by JavaScript. Personal access tokens are stored only as hashes, so a copy of our database would not reveal them. SSH keys are public keys only; Atomira never receives your private key. Access to production systems is limited to people who need it.
No service is perfectly secure. If a breach puts your rights at risk, we will notify the supervisory authority within 72 hours and tell you directly where the law requires it.
Found a vulnerability? Report it to security@atomiralabs.com rather than disclosing it publicly, and see our position on security research.
Children
Atomira is not intended for children. You must be at least 16, or the minimum age for consent to data processing in your country if that is lower. If we learn that we hold data about a child below that age, we will delete it.
Changes to this policy
We will update this page as the service develops. For changes that materially affect how we handle your data, we will give notice in the application or by email before they take effect, and update the date at the top.
Contact
Privacy questions and rights requests: hello@atomiralabs.com. See also our Terms of Service.