Privacy Policy

1. Controller

BranchSpine is operated by Dominik Fabisiewicz (CodeNiwa). Full contact details are in the imprint. You can reach us at app@codeniwa.com.

2. Hosting of the website

The website is hosted by Netlify, Inc. (USA). When you open it, Netlify processes technical data such as your IP address, the time of the request, the requested page and your browser's user agent in server logs. This is necessary to deliver the website and keep it secure (Art. 6(1)(f) GDPR). Transfers to the USA are covered by the EU–US Data Privacy Framework and/or the EU Standard Contractual Clauses.

3. GitHub

When you load a repository, your browser or the iOS app (including its widgets) connects directly to GitHub, Inc. (USA) at api.github.com to read the repository's branches and merged pull requests, and at avatars.githubusercontent.com to show contributor avatars. GitHub receives your IP address and the repository you requested. These requests are only made because you asked BranchSpine to show that repository; widgets repeat them roughly every 30 minutes to stay current (Art. 6(1)(f) GDPR). GitHub's own privacy statement applies. We never receive this data.

4. Access token

You can optionally enter a GitHub access token. On the website it is stored only in your browser's local storage; in the iOS app it is stored in the device's Keychain and shared only with BranchSpine's own widgets. It is sent only to api.github.com and never to us or anyone else. You can remove it at any time using the key button, by clearing your browser's site data, or by deleting the app. We recommend a fine-grained, read-only token.

5. Sign in with GitHub

On the website you can optionally sign in with GitHub to see your own repositories and a combined view of recent merges across them. Signing in uses the BranchSpine GitHub App, which can only read metadata, contents and pull requests, and only in the accounts and repositories where you install it. GitHub shows you these permissions before you agree.

After you approve, GitHub sends your browser back with a one-time code. To turn it into an access token, your browser sends the code once to a function on this website, hosted by Netlify (see section 2). The function adds BranchSpine's app secret, asks GitHub for the token and returns it to your browser. It does not store or log the code or the token. The same happens when the token is renewed, about every eight hours. This is necessary to provide the sign-in you requested (Art. 6(1)(b) GDPR).

While you are signed in, your browser stores the access token, the renewal token, your GitHub username and your avatar URL in local storage, and requests your repository list and their pull requests directly from api.github.com. "Sign out" deletes this from your browser. To revoke BranchSpine's access completely, go to GitHub → Settings → Applications.

6. Data stored on your device

The website stores the following in your browser's local and session storage: your optional token, your sign-in session if you signed in, the repositories you opened recently, a short-lived cache of GitHub responses (including your repository list), and whether you have already seen the intro animation. The iOS app stores the repositories and branches you saved and the merges it last loaded, in storage shared only between the app and its widgets. This is strictly necessary for the features you use (§ 25(2) TDDDG) and never leaves your device, except for the tokens as described above. Deleting the app removes its data.

7. Fonts

All fonts are served from this website. No third-party font services are used.

8. App Store

The iOS app is distributed through Apple's App Store. Downloads and any crash or usage statistics you choose to share with developers are handled by Apple under Apple's privacy policy. BranchSpine itself contains no analytics or crash-reporting SDKs.

9. Your rights

Under the GDPR you have the right to access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR). You also have the right to lodge a complaint with a data protection supervisory authority, for example the Bavarian State Office for Data Protection Supervision (BayLDA).

10. Contact

If you have any questions about this privacy policy, contact app@codeniwa.com.