Last updated
Privacy Policy
What Source collects, why it has it, who else sees it, and how to get it back or have it deleted. Written against what the code actually stores rather than against a template.
1. Who is responsible
Source is operated by Neuvikon, a şahıs şirketi (sole proprietorship) established in Türkiye. For the purposes of the GDPR and of Türkiye’s KVKK, that is the data controller for everything described in section 3, and it can be reached at neuvikon@gmail.com.
We are in two different roles at once
This distinction decides who you should ask about what:
- For your account, your billing and your support messages we are the controller. We decided to collect those and we answer for them — this policy covers them.
- For the content inside an organization — its tickets, pages, comments, whiteboards and attachments — the organization is the controller and we are its processor. We hold that content on its instructions. If your employer put you into a Source organization and you want to know what is in it or have something removed, they decide that, not us. The terms governing that role are in the Data Processing Addendum.
2. The short version
- We do not sell personal data, and we do not share it for advertising.
- We do not use your content to train machine-learning models.
- There is no analytics, advertising or tracking code on this product. The only cookie Source sets is the one that keeps you signed in — which is why you have never seen a cookie banner here.
- We never see your coding agent’s conversations or your source code. See section 3.5.
- You can export an entire organization, and delete your account, from inside the app.
3. What we collect
3.1 Your account
Your email address and display name; a hash of your password if you signed up with one; whether the address has been verified. If you sign in with Google or GitHub, we receive the name, email address and profile picture that provider hands over — never a password. If you have no picture, Source generates one from your email address so you have an avatar without us needing a photo of you.
3.2 Sessions and security
Each sign-in creates a session record holding its IP address and user agent, so a session can be recognised and revoked. Keys you generate for the CLI are stored only as a SHA-256 digest plus the last four characters — enough for you to tell two keys apart, not enough for anyone to use one. We also keep short-lived counters of how often an account has done rate-limited things like sending invitations.
3.3 What you and your team write
Organizations, teams, projects, tickets and their comments and change history, wiki pages, whiteboards, uploaded files and images, mentions and notifications. Any personal data in there is whatever your team chose to put there, and we hold it as processor for the organization.
Your personal space — personal pages, boards, todos, habits, and how you arranged your own project grid — is visible to nobody but you and is held as controller, under this policy.
3.4 Billing
If you subscribe, we store which plan you are on, how many seats are counted against it, and a reference to your customer and subscription records at Polar. Your card number, billing address and tax details go to Polar, our merchant of record, and never reach our systems.
3.5 Agent sessions
Source records that an agent session happened and what it cost: which tool, which ticket, who it ran for, how long it ran, and how many tokens went in and out. It does not receive the prompts you send your coding agent, the agent's replies, or your source code. What an agent writes into a ticket, a comment or a page it wrote deliberately, the same as a person typing it.
Concretely, a session record holds: the tool, the ticket, the project, the organization, the person whose key it ran under, when it started and last reported in, tokens in and tokens out, and an error message if it ended badly. That is the whole row.
3.6 Organization audit log
Administrative actions inside an organization — a member joining or being removed, a role changing, an invitation sent, a project created, a key issued or revoked — are recorded with who did it, whether it was them or an agent acting for them, what it was done to, and when. An organization’s owners can read this; it exists so they can answer “who changed this?”.
3.7 Support messages
When you write to us from inside the app we send your name, email address and message to our inbox, along with the page you were on and your browser’s user agent — context that usually saves a round trip asking for it.
3.8 Technical request logs
Our host records ordinary server-log information for requests reaching it: IP address, user agent, the path requested, and a timestamp. It is used to keep the service up and to investigate abuse.
4. Why we have it, and on what legal basis
| What for | Basis under GDPR Art. 6 |
|---|---|
| Creating your account, signing you in, running the workspace you came for | Performance of a contract (Art. 6(1)(b)) |
| Taking payment, counting seats, issuing invoices | Performance of a contract (Art. 6(1)(b)) |
| Answering a support message you sent us | Performance of a contract, or our legitimate interest in replying |
| Keeping the service secure: session records, rate limits, the audit log, abuse investigation | Legitimate interests (Art. 6(1)(f)) — a service nobody can abuse is in every user’s interest |
| Service email you cannot opt out of: address verification, invitations, billing notices | Performance of a contract |
| Keeping accounting and tax records of a sale | Legal obligation (Art. 6(1)(c)), largely discharged by Polar as merchant of record |
Under the KVKK the corresponding grounds are Art. 5(2)(c) — necessary for the performance of a contract — and Art. 5(2)(f), our legitimate interests, for the security items.
We do not rely on consent for anything today, because there is nothing optional to consent to: no analytics, no marketing tracking, no profiling. If that ever changes we will ask first, and this page will say so before it does.
5. Who else sees it
A handful of providers process data on our behalf so that Source can exist at all — a database, a host, an email sender, a payment processor, a cache. Each one, what it does, what reaches it and where it runs, is listed and dated on the sub-processor page.
That page also names the third parties that are deliberately not sub-processors, because they act on their own account rather than on our instructions — the sign-in providers, and Polar in its role as the seller on your invoice.
Beyond that, we disclose personal data only where the law compels us to, and only to the extent compelled. If we are ever asked for your data by an authority and are permitted to tell you, we will.
6. International transfers
We are established in Türkiye, and several of our providers process in the United States, so personal data does leave the European Economic Area.
- For EEA and UK data. Where we process workspace content for an organization in the EEA or the UK, the transfer rests on the European Commission’s Standard Contractual Clauses, incorporated into the Data Processing Addendum, with the UK Addendum where the UK GDPR applies. We pass equivalent obligations down to each sub-processor and rely on the EU–US Data Privacy Framework where a US provider is certified under it.
- Under the KVKK. Transfers abroad rest on the mechanisms Art. 9 provides following the 2024 amendments — principally a standard contract of the form the Kurul has published, notified to it as required.
7. How long we keep it
- Your account and personal space: until you delete the account. Deletion is not a flag — it runs a cascade that removes your personal pages, boards, todos and habits, your avatar and its stored file, your notifications, your agent keys, the support rows holding your words, and your membership of every organization. It is immediate and it cannot be undone.
- Organization content: for as long as the organization keeps it. Its owners decide, and deleting an organization takes its projects, tickets, pages, whiteboards, attachments and audit log with it in the same operation.
- Audit log: for the life of the organization, because its whole purpose is to still be there when somebody asks what happened months ago.
- Support correspondence: the in-app copy goes with your account; the email itself stays in our mailbox while we need it to deal with the matter and for a reasonable period afterwards for reference. Ask and we will delete it.
- Billing records: kept as long as tax and accounting law requires, which is longer than your account may last and is not something either of us can shorten.
- Cached project text: at most five minutes, then gone.
8. How it is protected
- Everything travels over TLS, and is encrypted at rest by our database provider.
- Passwords are stored as hashes. Agent keys are stored as SHA-256 digests — a stolen database row cannot be replayed as a key.
- A new address cannot produce a usable session until it has been verified by email.
- Every server function that touches your data checks who is asking and whether the thing they named is actually theirs, against one shared permission catalogue rather than per-screen guesswork. Viewers cannot write at all.
- Anything that sends mail, writes a file, or can be driven in a loop sits behind a rate limit, so a stolen session has a ceiling on the damage it can do.
- Administrative actions are recorded in the organization’s audit log, including when an agent did them.
No system is perfect. If we discover a breach affecting your personal data we will notify the relevant authority within 72 hours where the law requires it, and tell you without undue delay where the risk to you warrants it.
9. Your rights, and how to use them
Under the GDPR (Arts. 15–22) and the KVKK (Art. 11) you can ask for access to your data, for a copy in a portable form, for a correction, for deletion, for processing to be restricted, and you can object to processing we base on legitimate interests. You can also withdraw consent where we rely on it, though as noted above we currently do not.
Two of these you can exercise yourself, right now, without asking us:
- Export. An organization’s owner can download the whole thing as a complete, readable archive — every project, ticket, page, comment and audit entry, with references intact — from the organization’s settings.
- Delete. Your account settings delete your account and run the cascade described in section 7.
For anything else, write to neuvikon@gmail.com. We will answer within 30 days. We may need to confirm you are who you say you are first — we are not going to hand someone’s data to whoever writes in claiming their address.
If your request concerns content inside an organization you do not own, we will point you at its controller rather than act on it ourselves, and we will tell them you asked.
Complaining about us
If you think we have handled your data badly, tell us first — but you do not have to. In Türkiye you may complain to the Kişisel Verileri Koruma Kurumu (KVKK). In the EEA you may complain to the supervisory authority where you live or work, and in the UK to the Information Commissioner’s Office.
10. Cookies and local storage
Source sets one cookie: the session cookie that keeps you signed in. It is strictly necessary — without it you would be signed out on every navigation — which is why there is no banner asking you about it.
Your browser also stores your light/dark theme preference locally. That never leaves your device and never reaches us.
There is no analytics, no advertising, and no cross-site tracking on this product.
11. Children
Source is a tool for working teams and is not meant for children. We do not knowingly collect data from anyone under 16. If you believe a child has created an account, write to us and we will delete it.
12. Changes to this policy
When this policy changes, the date at the top changes with it. For a change that materially affects you we will also email the address on your account at least 30 days beforehand, and we will announce a new sub-processor before it starts processing — see the sub-processor page, which carries its own date for exactly that reason.
13. Contact
neuvikon@gmail.com reaches a person, not a ticketing queue. Mentioning which of the two roles in section 1 your question is about will get you a faster answer.