Privacy notice
Version 2026-10-04. duragit is in beta: data may be purged.
What duragit stores
- From Google sign-in: your email address, name and Google account identifier. Nothing else from your Google account.
- Your consent to these documents: which version, when, and the address you accepted from.
- Sessions: a hash of the session cookie, the browser's user agent, the address it signed in from and when it was last used.
- Passkeys: the public key, a name and usage times. The private key never leaves your device.
- Access tokens: only a one-way hash, the first and last characters, scopes and usage times.
- An audit log of security events (sign-ins, token and passkey changes, membership and repository changes) with the address, user agent and country of the request.
- What you push: repositories, their files and history, and the output of Actions runs.
Cookies
duragit sets only cookies it needs to work: the session cookie and short-lived cookies during sign-in. No advertising or tracking cookies, and no analytics scripts in your browser.
Processors
- Cloudflare hosts duragit (Workers, Durable Objects, D1, R2, Containers and Email). Cloudflare's request logs keep the client address, approximate location and user agent of each request for 7 days.
- Google provides sign-in.
- PostHog (United States) receives product events such as "signed up" with your duragit user id only: no name, email, address or location.
How long
- Audit log entries: 400 days. Sessions: 30 days after they end. Sent email records: 30 days.
- Databases can be restored to any point in the last 30 days, and backups are kept for up to 95 days, so deleted data can remain in them for that long.
- During the beta, data may be purged at any time.
Your rights
You can see your sessions and passkeys on your account page and end sessions there. You can delete your account yourself from your account page ("Delete your account"). To get a copy of your data, email security@duragit.com from the address on your account until the self-service export arrives.
Contact
- Security vulnerabilities: security@duragit.com
- Abuse, spam and illegal content: abuse@duragit.com
- Copyright (DMCA) notices: dmca@duragit.com