Android Privacy Policy

Scope and contact

This policy covers the GitSync.md Android app developed by Cody Bontecou, including the paid Google Play package md.gitsync.md. The iPhone and iPad privacy policy covers the iOS app separately. For Android privacy questions or data requests, email cody@isolated.tech.

Data used by the app

GitSync.md uses your GitHub account information, authentication credentials, and Git repository data to let you select, clone, review, commit, pull, and push repositories. It caches your GitHub username, display name, avatar URL, email address when available, and repository metadata on your device. It also stores local repository paths and app preferences.

Cloned files, Git history, branches, diffs, and commit author names and email addresses are processed on your device. When you perform network operations, the app sends the credentials and repository data needed for that operation to GitHub or the remote server configured for that repository. Pushing commits can publish file contents and commit metadata, including author identity, to that remote. The remote repository's access settings determine who can see that data.

GitHub sign-in and the OAuth helper

If you choose browser-based GitHub sign-in, the app opens our OAuth helper at oauth-server-beige.vercel.app, hosted by Vercel. The helper redirects you to GitHub with the repo and user:email scopes. You review and authorize access on GitHub; your GitHub password is entered on GitHub, not in GitSync.md.

After authorization, the helper receives a temporary authorization code and a state value, exchanges the code with GitHub for an access token, and returns the token to the Android app through its syncmd://auth callback. The token passes through this helper during sign-in. The helper implementation does not save the token to an application database. Vercel and GitHub may process request metadata, such as IP addresses, request URLs, timestamps, and error information, under their own service policies.

Alternatively, you can enter a GitHub Personal Access Token in the app. The app validates that token directly with GitHub and stores it on your device; this route does not use our OAuth helper.

Local storage, file access, and security

The Android app stores its access token and cached account information in app-private Android SharedPreferences. These preferences are not encrypted by the app. The app's backup rules exclude its main preferences file from Android cloud backup and, where supported by Android's data-extraction rules, device-to-device transfer.

The default clone location is a user-visible folder under Android/media when available, with app-specific external or internal storage as fallbacks. Files in user-visible storage can be accessed by file managers or other apps that have the necessary Android permissions. When you open files in another app, that app's privacy practices apply. Android storage permissions support these local file operations.

GitHub API requests and the browser OAuth exchange use HTTPS. Protect your device and credentials, choose appropriate token scopes, and share repository folders only with apps you trust.

Ads, analytics, and purchases

The Android app does not include advertising or an in-app analytics SDK, and does not sell personal data or use it for advertising or cross-app tracking. The paid app includes its features with a one-time Google Play purchase. Google handles payment processing and purchase administration; the app does not receive your payment-card details.

Google Play and Android may separately process purchase, installation, diagnostic, or service information under your Google account and device settings. These platform services are governed by Google's Privacy Policy.

Retention, deletion, and your choices

Signing out removes the locally stored GitHub token, cached profile, and cached repository list. Signing out does not delete cloned files, remote repositories, or commit history, and does not revoke a token at GitHub. You can revoke OAuth access or Personal Access Tokens in your GitHub account settings.

You can remove local repositories through the app or your file manager. Uninstalling or clearing the app's storage removes app-private data, but you should also check user-visible folders and any copies made by other apps or backups. Deleting a local copy does not remove data already pushed to a remote. Remote data and Git commit history must be managed with the relevant repository provider.

For information you send to support, we use it to handle your request. Email us to request access, correction, or deletion of support correspondence we hold; some records may need to be retained to meet legal obligations. Do not send passwords, access tokens, or private repository contents with a support request. Our OAuth helper has no application account or token database to delete; infrastructure providers manage their own operational records under their policies.

Service providers

The app uses GitHub for GitHub authentication, account information, and repository operations, Vercel for the browser sign-in helper, and Google Play for distribution and payments. Any other Git remote or editor you choose receives the data needed for the actions you request.

This website

This policy page is hosted through Cloudflare. Like other pages on this site, it conditionally loads Cloudflare Web Analytics after a first-party analytics gate allows it. The gate and hosting services receive ordinary network request metadata. Cloudflare Web Analytics provides aggregate page-view and performance measurements; it is separate from the Android app. See Cloudflare's Privacy Policy for its practices.

Children and policy changes

GitSync.md is a developer and productivity tool and is not designed for children under 13. Contact us if you believe a child has provided personal information to us. Changes to this policy will be posted on this page with an updated effective date.