Privacy notice

Version 2026-10-08. Rebasely is in beta: data may be purged.

What Rebasely stores

• From Google sign-in: your email address, name and Google account identifier. Nothing else from your Google account.
• Your consent to these documents: which version, when, and the address you accepted from.
• Sessions: a hash of the session cookie, the browser's user agent, the address it signed in from and when it was last used.
• Passkeys: the public key, a name and usage times. The private key never leaves your device.
• Access tokens: only a one-way hash, the first and last characters, scopes and usage times. SSH keys: the public key, its fingerprint, title and usage times.
• An audit log of security events (sign-ins, token, key and passkey changes, membership and repository changes) with the address, user agent and country of the request.
• What you push: repositories, their files and history (including the names and email addresses in commits), and the logs and artifacts of Actions runs.
• Stars: which repositories you starred.

Public repositories and stars

• A private repository is visible only to members of its organization.
• A public repository is visible to everyone, signed in or not: its name, files, full history, the names and email addresses in its commits, and its star count. Search engines may index its pages.
• Star counts are shown to anyone who can read the repository. Who starred a repository is not shown to anyone; only you see the list of repositories you starred.
• When a repository is made private, the stars of people who can no longer read it are deleted.

Cookies

Rebasely sets only cookies it needs to work: the session cookie and short-lived cookies during sign-in. No advertising or tracking cookies, and no analytics scripts in your browser. duragitusercontent.com, which serves raw files, sets and reads no cookies.

Processors

• Cloudflare (United States and its global network) hosts Rebasely: Workers, Durable Objects, D1, R2, Containers and Email. Cloudflare's request logs keep the client address, approximate location (country and city), network and user agent of each request for 7 days.
• Google provides sign-in.
• PostHog (United States) receives product events from Rebasely's servers, never from your browser: the event's name and time (such as "signed up", "repository created" or "repository page viewed") and Rebasely's own identifiers for the user, organization and repository involved. It receives no name, email address, IP address or location, and Rebasely turns off PostHog's location lookup. Error reports from Rebasely's servers go there too.

How long

• Audit log entries: 400 days, also after the account they are about is deleted. Sessions: 30 days after they end. Sent email records: 30 days.
• Databases can be restored to any point in the last 30 days (Durable Object point-in-time recovery and D1 Time Travel), so deleted data stays restorable for that long.
• Nightly backups of repositories and databases are kept for up to 95 days, so deleted data can remain in them for that long.
• Data exports can be downloaded for 7 days, then they are deleted.
• During the beta, data may be purged at any time.

Deleting your data

You can delete a repository, an organization you own, or your whole account yourself, from its settings or your account page; each needs a recent passkey confirmation. Deleted things stop being served at once and are removed from live storage within minutes. Copies then remain only in the restore window and the backups above, until those age out. Deleting your account also removes your stars, sessions, tokens, keys and passkeys.

Downloading your data

"Download my data" on your account page prepares a file with your profile, sign-in identities, consents, organizations and memberships, stars, token, key, session and passkey details (never secrets or hashes), audit entries about you, the Actions runs you started, and the usage of organizations you own. It is usually ready within a few minutes, at most an hour, and the link is emailed to you. Repository contents are copied with git itself (git clone --mirror); the file lists your repositories and their clone addresses.

The earlier version (mvp.duragit.com)

An earlier version of Rebasely, then called duragit, ran at mvp.duragit.com. Its accounts, sessions and tokens were not moved to rebasely.com. When it is removed, its database, which holds those accounts and token hashes, is deleted; Cloudflare's Time Travel history of that database ages out within 30 days after that. A final copy of its repositories is kept for 95 days, then deleted.

Your rights

You can see your sessions and passkeys on your account page and end sessions there, download your data, correct your name through Google, and delete your account. If something here does not work for you, or you have a question about your data, email security@rebasely.com from the address on your account.

Contact

• Security vulnerabilities: security@rebasely.com
• Abuse, spam and illegal content: abuse@rebasely.com
• Copyright (DMCA) notices: dmca@rebasely.com (see the DMCA policy)