Privacy

You can use Sasca without an account. If you sign in, we store a little about you, listed below, and nothing else.

Who is responsible

Sasca is run by Marc-Alexandre Montpas, in Finland, who decides what is stored and why (the “controller” under the EU’s General Data Protection Regulation). Questions and requests: marc@montpas.me.

What we store

• Without an account: nothing about you. Like any web server, ours logs requests (IP address, page, browser) to keep the site running and secure.
• With an account: your name, email address and avatar as GitHub or GitLab share them; your GitHub or GitLab user ID and username; when you signed up and last signed in.
• For each signed-in browser: its browser name (user agent), when it signed in and was last used, and a hash of its session token.
• If you set up notifications: where they go (a Slack or Discord webhook URL, a Matrix homeserver, room and access token, or your own address and the secret Sasca signs with), whether the last one arrived, and the messages sent, for 30 days.
• If you connect an agent (like Claude Code) to Sasca: its name, when you allowed it and when it last acted for you, and its tokens, stored only as hashes, until you disconnect it.
• If you add a private repository: which installations of Sasca’s GitHub App you can use and the account each is on (no GitHub token is kept: Sasca asks GitHub for a short-lived one each time it fetches); if you connect GitLab, the tokens GitLab gives Sasca to read repositories (nothing else), encrypted; and what Sasca records about any repository (its changes, file paths and function names), shown only to you and others who connect the same repository from their own account. Whoever runs Sasca’s servers can technically read the database, as with any hosted service; our logs name private repositories only by an ID.

We don’t store your GitHub or GitLab password or sign-in token: we use the token once, to read your profile. There are no analytics or tracking. The cookies are sasca_session, set when you sign in, which keeps you signed in; sasca_hasura, which tells our data service who you are for 14 minutes at a time (renewed while you use the site); and sasca_oauth, for the minute a sign-in takes.

Why

To give you your account and keep it secure (GDPR article 6(1)(b), providing the service you sign up for), and server logs to run the site safely (article 6(1)(f), legitimate interest).

How long

Your account data until you delete your account. A private repository and everything recorded about it are deleted once nobody who added it has an account any more. A browser’s session ends after 30 days without use, or when you sign it out. Notification messages are kept 30 days after they’re sent; server logs, 14 days.

Who else processes it

• Hetzner Online GmbH hosts our servers, in Finland, under a data processing agreement.
• Grafana Labs stores our server logs and measurements, in Canada, to keep the site running.
• GitHub or GitLab, when you choose to sign in with them or connect private repositories, under their own privacy policies.
• Wherever you send notifications (Slack, Discord, a Matrix server, your own address) receives the changes in them, under its own policies.

Your rights

You can download everything we store about you and delete your account from your account page. You can also ask us to correct, restrict or explain what we store, or object to it, at marc@montpas.me. If you think we handle your data wrongly, you can complain to the Finnish Data Protection Ombudsman (tietosuoja.fi).