Privacy Policy
Last updated
This policy explains what Tack collects, why we collect it, and who processes it on our behalf. Tack is in closed beta and Phase A of the product plans work only: it reads your repositories and proposes plans, and it does not write to your repositories.
Who we are
Tack is operated by the Tack team. For any privacy question, or to request access to or deletion of your data, write to hello@tackdev.com.
What we collect
- Account identity. When you sign in with GitHub we receive your GitHub user ID, login, display name, avatar URL, and the email address associated with your GitHub account. Sign-in uses identity-only scopes and is handled by Supabase Auth.
- Connected repository metadata. The full name of each repository you connect, whether it is active, and the last commit SHA we scanned.
- Repository content we read to plan. Source code, file tree entries, diffs between commits, commit messages, and the titles and bodies of issues and pull requests in the repositories you connect.
- Workflow data. Run records, the plan candidates we generate, per-stage model outputs, token and cost accounting, and the approval or rejection you record in the dashboard.
- Waitlist email. If you submit the waitlist form on our landing page, we store the email address you entered.
- Product analytics. Aggregate page-view traffic through Vercel Analytics, which is cookieless and does not build a cross-site profile of you.
Repository content and our LLM provider
Repository content, including source code, file tree entries, diffs, commit messages, and issue and pull request text, is sent to our LLM provider through the Vercel AI Gateway to generate plans. This is the core of what Tack does, and you should not connect a repository whose contents you are not permitted to share with a third-party AI provider.
We read your repositories with a short-lived GitHub App installation token that is scoped to a single repository and to read-only permissions. The token is held in memory for one operation and revoked immediately afterwards. It is never written to our database, our logs, or a task payload.
How much we read is bounded on purpose. We cap the number of files, tree entries, issues, pull requests, and commits per scan, and we cap the size of each file and diff we fetch. We stop at those limits rather than pulling a repository in full.
Operational visibility
We orchestrate runs on Trigger.dev. Run metadata and task payloads, which include repository names, run parameters, and stage outputs, are readable by Tack operators in the Trigger.dev operational dashboard. We use that access to debug failed runs. During the beta this is how we keep the product working, and it is the main reason to treat Tack as unsuitable for repositories under a strict confidentiality obligation.
How we use data
- To read your repositories and generate plan candidates.
- To show you runs, plans, and their history in the dashboard.
- To meter usage and enforce per-run and per-tenant budgets.
- To debug failures and keep the service available and secure.
- To send you transactional email, such as the waitlist confirmation.
We do not sell your data, and we do not use your repository content for advertising.
Processors we share data with
- Vercel — application hosting, edge network, and cookieless analytics. Also operates the Vercel AI Gateway that our model calls pass through.
- Supabase — authentication and the PostgreSQL database holding your account, repositories, and run records.
- Anthropic — the LLM provider that generates plans, reached through the Vercel AI Gateway.
- Trigger.dev — background job orchestration for workflow runs.
- Resend — transactional email delivery.
- GitHub — the source of your identity and of the repository content you ask us to read.
Cookies
We set strictly necessary cookies only: the Supabase Auth session cookies that keep you signed in to the dashboard. We do not set advertising or cross-site tracking cookies, and Vercel Analytics runs without cookies. Because we set no non-essential cookies, we do not show a cookie consent banner.
Retention
Account, repository, and run records are retained while your account is active. Repository file contents are not stored as files; they are read into memory for a run, and what persists is the derived plan text, the stage outputs, and bounded scan metadata such as counts and commit SHAs. Waitlist emails are retained until you ask us to remove them. Operational logs and orchestration run history are retained on a rolling basis by our hosting and orchestration providers.
Security
Data is encrypted in transit. Any provider token we do store is encrypted at rest with AES-256-GCM before it reaches the database. Database access is row-level-security scoped so one tenant cannot read another tenant records.
Your choices
You can disconnect a repository at any time, which stops future scans of it. To request a copy of your data, correction of it, or deletion of your account and its run history, email hello@tackdev.com. During the beta we handle these requests manually.
Children
Tack is not directed at children and is not intended for anyone under 16.
Changes to this policy
If we change this policy we will update the date at the top of this page. Material changes will also be announced to signed-in users.
Contact
Questions about this policy or our Terms of Service go to hello@tackdev.com.