Privacy Policy

Last updated: 23 October 2026

The short version

• >commit_ is in closed beta: we let projects and people in a few at a time.
• We collect what you give us (your email, your project, board posts, invites), what we read from the stores and tools you choose to connect, and analytics about how the site is used.
• We use it to run the Service, keep your split record, send the invites you ask us to send, and learn whether people want this product. We don’t sell it, and we don’t use it for ads.
• Our providers: Cloudflare (hosting and database), Resend (email), PostHog (analytics), Stripe (payouts), and the revenue sources you connect.
• You can ask to see, correct, export or delete your data at [email protected].
• One exception to deletion: a signed split is an agreement other people rely on, so its signed versions stay in the record.

1. Who is responsible for your data

Commit Split, Inc., a Delaware corporation (“>commit_”, “we”) is the controller of the personal data described here. Contact: [email protected].

This policy covers commit.cx and the >commit_ product.

2. What we collect

2.1. When you start a project. Your answers to the five-question form: project name, whether it’s a game, an app or something else, team state (solo, have a team, looking), team size and roles, stage, how you plan to split shares (or whether you’ll bring people in), and whether you’d want us to publish it.

2.2. Your account. Your email address; there is no password. The name you give us. The projects you join, your role, contribution points, milestones, the split versions you sign or propose, your receipts and the time of each signature.

2.3. When you invite people. The email addresses you type in. We send each address one email from [email protected], saying you invited them to your project, with your email as the reply-to address. We store the addresses with your project. If you were invited and don’t want to hear from us, write to [email protected] and we will delete your address.

2.4. When you post on the Find a team board.

• An open role: the roles, a short note and a contact.
• A profile: your name, nickname, skill, hours a week, number of projects shipped, a short pitch, tools and an optional portfolio link (http or https only), and a contact.
• An application to a role: the role, a short note about you and a contact.

Your nickname, skill, pitch, hours, shipped count, tools and link are shown publicly on the board. Your name and contact are never shown in public feeds. We store applications and contacts and may use them to put people in touch; we don’t forward them automatically.

2.5. If you connect a revenue source. Figures read with read-only access from Stripe, RevenueCat, App Store Connect or Google Play, or figures you enter by hand. This is mostly aggregate revenue, not data about your app’s end users. We store your access keys for these sources encrypted.

2.6. If your project connects its git repository. To mark a shipped title “checked” on a person’s profile, we read, with read-only access, the commit author identities (names, email addresses, usernames) and the number and dates of each person’s commits. We never store source code. A title is checked when it has a live store listing and the person’s work is in the project’s git history. People who don’t commit, such as artists or sound designers, are checked when the project owner confirms them, so we store that confirmation and who gave it. Commit history can include people who are not >commit_ users; we use their identities only to match commits to members and don’t contact them.

2.7. If you use the API, MCP or agents. The keys you create, which agent used them, and what each agent read or proposed, including who asked for each proposed change.

2.8. If we publish your app. Payout account details, tax forms and identity checks are collected and held by our payment provider, Stripe. We receive what we need to make and record payouts, such as payout status and the last digits of an account.

2.9. Spam protection. With each form submission we store your IP address and the time, to limit how many submissions one address can make in an hour. Forms also contain a hidden field that only bots fill in.

2.10. Analytics. We use PostHog to see how people move through the site. This includes:

• pages viewed, buttons clicked and steps of the form reached;
• your answers to choice questions as you go (free-text answers are not sent field by field, and the project name is never sent);
• the ad or link that brought you (UTM parameters);
• device, browser, approximate location derived from your IP address, and referring page.

Until you click Accept on the consent bar, or after you click Decline, this runs without cookies or any storage in your browser: PostHog counts visits with a temporary identifier calculated on its server, which can’t follow you across days or sites. If you click Accept, PostHog also sets a cookie so it can recognise your browser on later visits, records how you use the page (session replay, with what you type into fields masked), and reports errors in the page so we can fix bugs.

After you sign up, we link this activity to your email address, so the steps before and after sign-up count as one person. Analytics requests go through our own address (commit.cx/ingest) before reaching PostHog; we pass your IP address on so location is accurate.

2.11. Logs. Sign-ins, staff access to a project (every access is logged), and security events.

2.12. Messages. If you write to us, we keep the message and your contact details to reply.

3. Why we use it, and our legal bases

For people in the EU, EEA and UK, the GDPR requires a legal basis for each use.

We don’t make decisions about you based solely on automated processing that have legal or similarly significant effects. Payout amounts are calculated automatically from rules your team signed, and any member can see and check the calculation.

4. Who we share it with

We don’t sell your personal data, and we don’t share it for cross-context behavioural advertising. We share it only with:

4.1. Service providers (processors):

We will update this list before adding a provider that handles personal data.

4.2. Sources you connect. Stripe, RevenueCat, Apple App Store Connect, Google Play, and GitHub, GitLab or another git host, when you or your project choose to connect them. We only read from them, with read-only access.

4.3. Your teammates. Members of a project see that project’s split, history, revenue figures and the names of the other members.

4.4. The public. Board posts, as described in 2.4.

4.5. Agents you authorise. Agents and apps using a key you or your teammates created can read the project’s data that key allows.

4.6. Legal and safety. If the law requires it, to protect people’s rights or safety, or as part of a sale or merger of our business (with notice to you).

5. Cookies and similar technologies

We don’t use advertising cookies or ad pixels.

Until you answer the consent bar, and after you click Decline, we set no analytics cookies and store nothing for analytics in your browser. PostHog keeps your answer to the consent bar in your browser’s local storage, so we don’t ask again.

If you click Accept, PostHog sets a first-party cookie and a local storage entry on commit.cx with a random ID, so it can tell visits from the same browser apart and keep a session together. It also stores session properties such as the ad that brought you. Session replay and error tracking are turned off for our own test browsers.

You can block or delete cookies in your browser settings; the site works without them. Signing in to the product uses a cookie to keep you signed in, which is strictly necessary.

6. How long we keep it

• Project answers and board posts from projects that don’t have access yet: up to 24 months, or until you ask us to delete them.
• Invited people’s email addresses: with the project, until the inviter or the invited person asks us to delete them.
• IP addresses stored for spam protection: 30 days.
• Analytics: 12 months. Session replays: 30 days.
• Git commit data: while the repository is connected, and deleted within 30 days after it’s disconnected.
• Account data: while your account is open, and deleted within 30 days after you close it, except signed split versions and records the law requires us to keep.
• Signed split versions: for as long as the project exists and any member can rely on it. See section 7.3.
• Tax and payout records: as long as the law requires.
• Backups: deleted data may remain in backups for up to 30 days.

7. Your rights

7.1. Everyone. You can ask us at [email protected] to see the data we hold about you, correct it, export it, or delete it. We’ll answer within one month, and won’t charge you. We may need to confirm it’s you, usually by email.

7.2. EU, EEA and UK. You also have the right to restrict or object to our use of your data, including analytics based on legitimate interest, to withdraw consent at any time, and to complain to the data protection authority where you live.

7.3. Signed splits. A signed split is an agreement that other members rely on. If you ask us to delete your data, we close your account and delete what we don’t need, but signed versions you are part of stay in the record, because the other members have a legitimate interest in proof of their agreement and because we may need them for legal claims. Your teammates can already see these versions.

7.4. California (CCPA/CPRA). California residents have the right to know what personal information we collect and how we use it, to delete it, to correct it, and to opt out of its sale or sharing. We don’t sell or share personal information as those terms are defined, and we don’t use sensitive personal information for anything beyond providing the Service. The categories we collect are listed in section 2: identifiers (email, IP address), commercial information (revenue and payout data), internet activity (analytics), and professional information (board profiles). We don’t create inferences or profiles about you. We won’t treat you differently for using your rights. You can use an authorised agent to make a request.

7.5. Other places. If the law where you live gives you other rights, write to us and we will honour them.

8. International transfers

Our providers process data in the United States and other countries, which may have different data protection laws from yours. When we move personal data out of the EU, EEA or UK, we rely on the Standard Contractual Clauses in each provider’s data processing agreement, and on the EU-US Data Privacy Framework where the provider is certified under it.

9. Children

>commit_ is not for children. You must be at least 18 to use it. We don’t knowingly collect data from children. If you believe a child has given us data, write to [email protected] and we will delete it.

10. Security

Data is encrypted in transit and at rest, store and API keys are encrypted separately, staff open a project only on a support request, and every staff access is logged. Details are on our Security page. No system is perfectly secure; if a breach affects your data, we will tell you within 72 hours of confirming it, and the authorities as the law requires.

11. Changes to this policy

We’ll update this policy as the product changes. We’ll change the date at the top, and email you about material changes at least 30 days before they take effect.

12. Contact

Privacy questions and requests: [email protected], or use our contact page. Security issues: [email protected].