Privacy
Privacy at GitPin
GitPin is a local, read-only MCP server. The public website has no accounts, forms, or client configuration collection.
Product telemetry
The CLI and MCP transports do not send telemetry.
GitPin never sends repository contents, filesystem paths, Git history, questions, MCP requests, answers, citations, registry configuration, secret tokens, or credentials to the website analytics service.
Optional website analytics
The site is built with analytics disabled unless its operator configures a dedicated GitPin PostHog project. When enabled, transport is cookieless and limited to explicit launch-funnel event names and validated event properties only. Automatic pageview/pageleave collection is disabled. Autocapture, feature flags and remote configuration, session replay, and person profiles are disabled.
The outbound transport includes the allowlisted event name and property, the public PostHog project key (not a secret), cookieless anonymous `distinct_id`, optional anonymous `$session_id`, optional SDK-required `$process_person_profile` flag, event timestamp, and SDK-generated event UUID used for deduplication.
No automatic URL/referrer/host/browser/device/screen fields are sent.
The browser asks PostHog not to perform GeoIP enrichment on every permitted event. At production verification time, the dedicated GitPin PostHog project was configured to discard raw IP addresses, and the bounded query contained no raw-IP or GeoIP-derived fields. This is deployment-specific: other project keys must be verified independently by their operators.
Use the website analytics control above to store an opt-out in this browser until site data is cleared. A stored opt-out prevents the analytics SDK from loading on later visits, and activating it stops subsequent capture immediately. If the browser blocks preference storage, GitPin fails closed and does not load website analytics.
Test traffic is excluded only when automated-browser signals are present and a deliberate marker is set (`gitpin_test_traffic=true` in the page URL or `window.__gitpinTestTraffic === true`).
Security and contact
To report a vulnerability, follow the security policy. For public product questions or corrections, use the issue tracker.