Privacy policy

Last updated:

first-commit is a free, personal open-source project. It doesn't sell data, show ads or use tracking cookies, and the CLI's install counts are anonymous. You can ask for your data to be deleted at any time.

This policy covers first-commit: the website at first-commit.dev, its public API, its MCP server and the create-first-commit CLI. It is run by Marlon Chaviano, who is responsible for your data and can be reached at chavianomarlon@gmail.com.

Signing in with GitHub or Google

An account is optional: browsing, the configurator and the CLI work without one. If you sign in, we receive:

  • GitHub (scopes read:user and user:email): your name, email address, profile picture and GitHub username, plus an access token. The token is stored only to read your username and, when you publish a kit, to check that you can access the repository it comes from. It is never used to write to GitHub.
  • Google (scopes openid, email and profile): your name, email address and profile picture.

We use this only to identify you, show your profile picture and username, and attribute the kits and organizations you create. We don't access anything else in your GitHub or Google account, and we don't send you email because you signed in.

first-commit's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is never sold, used for advertising, used to train AI models or shared with anyone except the service providers listed below, who process it only to run first-commit.

What you publish

Kits you publish (their manifest, files and version history), your username and your public profile are public by design. Kits limited to an organization are visible only to its members. CLI tokens you create are stored only as a hash.

CLI telemetry

When you install, update or add a kit, the CLI sends: the kit and its version, the options and skills chosen, the agents, the package manager, the CLI version, the operating system and a random ID generated on your machine. It never sends project names, paths, code or anything that identifies you. Our hosting provider tells us the country the request comes from; the IP address isn't stored with the event. This data feeds the public ranking and each kit's statistics. It isn't sent in CI, for kits installed from a local folder, or when DO_NOT_TRACK=1 or KITS_TELEMETRY=0 is set.

Newsletter

If you subscribe, we store your email address and its status. Nothing is sent until you confirm from the email we send you, and confirmation links expire after 7 days. Every issue has an unsubscribe link, and mail apps that support one-click unsubscribe can use it directly.

Contact form and reports

  • Messages sent from the contact page are emailed to Marlon Chaviano with your email address as the reply-to. They aren't stored in our database.
  • When you report a kit we store the reason, your description, an optional contact and a salted hash of your IP address (to detect abuse without keeping the IP).
  • The Describe your project recommender, when enabled, sends only the text you write to Anthropic to suggest a kit. Without it, the suggestion is made on our server.
  • The brand importer fetches only the website address you enter, to read its colors and fonts.

Abuse protection

To limit spam, the API, newsletter, reports and contact form count requests per IP address in short-lived counters (one hour at most) that expire on their own. Our hosting provider may keep standard request logs for a short period.

Cookies and local storage

Only the session cookie that keeps you signed in. No advertising or third-party tracking cookies.

Analytics

Vercel Web Analytics counts page views without cookies: it records the page, referrer, country and device type, and can't follow you across sites or identify you.

Service providers

  • Vercel: hosting and cookieless page-view analytics.
  • Neon: database (accounts, kits, subscribers, statistics).
  • Upstash: event queue, rate-limit counters and scheduled jobs.
  • Resend: sending email (newsletter, confirmations, contact messages).
  • GitHub and Google: sign-in. GitHub also hosts the source of the kits.
  • Anthropic: the optional recommender, only the description you write.

We don't use any payment provider: first-commit doesn't charge for anything.

How long we keep data

  • Account data and OAuth tokens: until you delete your account. Sessions expire on their own.
  • Newsletter: until you unsubscribe or ask us to delete it.
  • Reports: as long as needed to moderate the kit.
  • Telemetry: kept for statistics. It is anonymous, so it can't be linked to you or deleted per person.

Your rights and deleting your data

Write to chavianomarlon@gmail.com from the email address of your account to get a copy of your data, correct it or delete your account. Deletion covers your account, OAuth tokens, sessions, CLI tokens and newsletter subscription, and is done within 30 days. Kits you published are removed or transferred, as you prefer. You can also revoke first-commit's access at any time from your GitHub settings (Applications) or your Google account (Third-party connections).

Children

first-commit is a developer tool and isn't directed at children under 16.

Changes

If this policy changes in a meaningful way, the date above changes and the update is announced in the changelog.