# Privacy Policy **Last Updated:** May 19, 2026 ## Introduction KitLab ("we," "our," or "the App") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your information when you use the KitLab mobile application. By using KitLab, you agree to the practices described in this policy. KitLab is a mobile client for GitLab that helps you manage your projects, issues, merge requests, and receive push notifications. We only collect the minimum data necessary to provide these services. ## Data Collection ### Backend Data (Stored on Our Servers) We collect the following data in our PostgreSQL database: - **User Account Information:** Your GitLab user ID, generous webhook/notification limits, rate limits (set to prevent abuse only), and account creation date. - **Device Tokens:** Firebase Cloud Messaging (FCM) tokens for push notifications, your device platform (iOS or Android), token registration date, and last used date. - **Webhook History:** Event types, project IDs, and timestamps of received/processed webhooks (used for debugging and service monitoring). Automatically deleted after 30 days. - **Usage Tracking:** Monthly counts of webhooks and notifications sent (used for service monitoring, debugging and abuse prevention). - **Webhook Registrations:** Project IDs, GitLab webhook IDs, enabled status, and registration dates. ### Local Data (Stored on Your Device) The following data is stored locally on your device using secure storage: - **Authentication Credentials:** OAuth access tokens, refresh tokens, token expiration dates, GitLab server URL, and authentication method (OAuth or Personal Access Token). - **App Preferences:** Cache duration settings stored in shared preferences. ### No Personal Information We do not collect: - Your name, email address, or phone number - Your location data - Your browsing history - Any data from your GitLab account beyond your user ID - Any analytics or crash reporting data ## Data Usage We use the collected data for the following purposes: - **Push Notifications:** FCM tokens are used to send you notifications about GitLab events (issues, merge requests, pipeline status, etc.). - **Service Delivery:** User IDs and authentication tokens are required to communicate with your GitLab instance. - **Debugging:** Webhook history and device information help us diagnose and fix technical issues. - **Abuse Prevention:** Usage tracking helps identify and prevent abuse of the notification service. ## Data Sharing We do not sell, rent, or trade your personal information. We only share data in the following limited circumstances: - **Firebase Cloud Messaging:** FCM tokens are shared with Google's Firebase service solely for delivering push notifications. Firebase's privacy policy is available at [https://policies.google.com/privacy](https://policies.google.com/privacy). - **GitLab API:** Your authentication tokens are used to communicate with your GitLab instance. We do not have access to your GitLab password or any data beyond what you authorize through OAuth or Personal Access Tokens. - **Legal Requirements:** We may disclose data if required by law or to protect our rights, property, or safety. ## Data Security We implement reasonable security measures to protect your information: - **Encryption:** Authentication tokens are stored using Flutter Secure Storage, which uses the device's secure enclave/keychain. - **Secure Transmission:** All data transmitted between the app and our servers is encrypted using HTTPS/TLS. - **Access Controls:** Access to our backend database is restricted to authorized personnel only. - **Admin Dashboard:** Our admin dashboard shows only basic technical information (GitLab user ID, truncated device tokens) necessary for debugging and account management. No personally identifiable information such as names, emails, or personal data is displayed. ## Data Retention We retain your data for the following periods: - **User Account Data:** Retained until you delete your account or request data deletion. - **Device Tokens:** Retained until you unregister the device or delete your data. - **Webhook History:** Retained for up to 30 days for debugging purposes. - **Local Data:** Retained on your device until you sign out or uninstall the app. ## Your Rights You have the following rights regarding your data: - **Data Deletion:** You can request deletion of all your data (except account record) through the app or by contacting us. This will delete device tokens, webhook history, usage tracking, and webhook registrations. - **Account Deletion:** You can request complete account deletion through the app or by contacting us. This will delete all your data including your account record. - **Opt-Out:** You can disable push notifications at any time through your device settings or the app. To exercise these rights, contact us at the email address provided below. ## Children's Privacy KitLab is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately. ## Changes to This Policy We may update this Privacy Policy from time to time. We will notify you of any material changes by: - Posting the new policy on our website - Updating the policy date at the top of this document - Sending a notification through the app (if technically feasible) Your continued use of KitLab after such changes constitutes your acceptance of the updated policy. ## Contact Us If you have questions, concerns, or requests regarding this Privacy Policy, please contact us: - **Email:** kitlabofficial@proton.me We will respond to your inquiry within a reasonable timeframe, typically within 30 days.