Privacy
Last updated 31 October 2026
Draft for review. This page is not legal advice.
In short
- We keep your account details, your apps and data, what your agents do, and usage events we record ourselves.
- No ad trackers and no analytics companies. Signed out visitors get no analytics cookie unless they allow it.
- Anonymous events go after 13 months and search text after 180 days.
- You can export and delete everything in Settings.
Who is responsible
[COMPANY OR PERSON NAME], [COUNTRY], is the controller of your personal data on Commons. Contact [CONTACT EMAIL]. For the apps people publish, the person who publishes an app decides what that app does with what you type into it, and is responsible for it.
What we collect and where it comes from
| What | Where it comes from |
|---|---|
| Account details: name, username, email address, avatar | GitHub or Google, when you sign in |
| Your GitHub sign in, stored encrypted, if you connect GitHub | GitHub |
| Your apps, every version of them, and what you share | You and your agents |
| Data you save in apps | You, through the apps you use |
| Agent activity: what each agent changed, and the reason it stated | Your agents |
| Agents and tokens you connect | You and your agents |
| Usage events: views, uses, forks, searches, sign ups | Your use of Commons, recorded by Commons itself |
| An anonymous visitor id, if you allow the analytics cookie | Generated by Commons |
| Reports you send | You |
| Security logs: addresses, browser details, errors and failed requests | Your device, through Cloudflare's logs |
| How many bytes each app serves per day | Generated by Commons, per app and not per person |
Your email is never shown to other members or to apps. There are no ad trackers and no analytics companies.
Why, and on what legal basis
| Why | Legal basis |
|---|---|
| Run your account, host your apps, connect your agents and sync GitHub | Performing our contract with you |
| Keep Commons safe: rate limits, abuse reports, moderation, security logs | Legitimate interests in keeping the service and its members safe |
| Show you and your agents what was changed and why | Performing our contract with you |
| Understand whether Commons works, from signed in usage events | Legitimate interests in improving Commons. You can object, see Your rights. |
| Count page views of shared apps, with no identifier attached | Legitimate interests. No cookie is used and nothing links a view to you. |
| The analytics cookie and what it records for signed out visitors | Your consent, which you can change on the Cookies page |
| Keep records and answer legal requests | Legal obligation, or legitimate interests in defending legal claims |
Who processes it for us
| Who | What they do |
|---|---|
| Cloudflare | Hosting, database, file storage, logs. Everything on Commons runs there. |
| GitHub | Sign in, and repo sync if you connect it. |
| Sign in with Google. | |
| Our email provider | Commons sends no email today. If that changes, we will name the provider here first. |
We don't sell your data. Apps you open may contact other services listed in their commons.json, and those services get whatever the app sends them.
Where it's stored and international transfers
Cloudflare runs Commons on its global network, so your data may be handled in the United States and other countries. Where data leaves the EU or UK for a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses and the UK addendum in our providers' terms, or on the EU and UK data privacy frameworks where a provider is certified. Write to [CONTACT EMAIL] for a copy.
How long we keep it
| What | How long |
|---|---|
| Your account, apps, data and agent activity | Until you delete them or your account |
| Usage events linked to your account | Until you delete your account |
| Anonymous events, with no account attached | 395 days (13 months), then deleted |
| The text of searches | 180 days, then blanked. The count stays. |
| Signed in sessions | 30 days, and 7 days after being signed out or revoked |
| Bundle links | Work for 24 hours. The record is deleted after 30 days. |
| GitHub webhook records | 7 days |
| Bytes served per app | 35 days |
| Agent access tokens from connecting with sign in | 1 hour, renewable for up to 90 days of no use |
| Security logs at Cloudflare | Up to 30 days |
| Reports | Until the account or app they are about is deleted, or longer if a legal claim needs them |
Who on our side can see what
Only the people who run Commons have admin access. They can see reports, member lists and totals in the admin pages, and can open the database to fix problems or answer abuse and legal requests. Access is limited to those people and admin actions are logged. They don't read your private apps or app data unless that is needed for one of those reasons. Other members and apps never see your email.
Your rights
Depending on where you live, you can ask to see your data, correct it, delete it, get a copy, limit how we use it, or object to our use of it. Where we rely on consent you can withdraw it at any time.
- Export everything you can see in Settings, or ask your agent to call
export_account. - Delete your account in Settings. That removes your projects, data, activity, connections and usage events.
- Change the analytics choice on the Cookies page.
- For anything else, write to [CONTACT EMAIL]. We answer within a month.
You can also complain to your local data protection authority.
Children
Commons isn't for children under 13, or under 16 where local law requires it. If you think a child has given us their data, write to [CONTACT EMAIL] and we'll delete it.
Security
Apps run on a separate domain in a browser sandbox, so they can't reach your session or our API. Sessions and tokens are stored only as hashes, GitHub tokens are encrypted, and traffic is always encrypted. No service is perfectly secure. If something goes wrong that affects you, we'll tell you as the law requires. See Security for how to report a problem.
Cookies
This is every cookie Commons sets. You can change your choice about analytics on the Cookies page.
| Name | Purpose | Lifetime |
|---|---|---|
| __Host-commons_sid | Keeps you signed in. Essential. | 30 days, or until you sign out |
| __Host-commons_oauth_state | Protects sign in with GitHub or Google. Essential. | 10 minutes |
| __Host-commons_rt | Remembers the page to go back to after sign in. Essential. | 15 minutes |
| __Host-commons_ref | Remembers the invite or shared app that brought you, so you can join during the invite only beta and the person who shared gets credit. Set when you open an invite or choose to sign up from a shared app. If you allowed analytics, also set when you open a shared link. | 30 days, or until sign up |
| __Host-oauth-* | Protects the screen where you approve an agent. Essential. | Up to 1 hour |
| __Host-commons_consent | Remembers your choice about analytics. Essential. | 180 days |
| __Host-commons_anon | A random id that counts return visits and how signed out visitors move through a shared app. Analytics. Only set if you allow it. | 1 year |
If you use a shared app while signed out, what you type stays in your browser's local storage so you don't lose it, until you sign up or clear it. Apps themselves run with no cookies and no storage.
Changes to this notice
We may update this notice. For an important change we'll tell you in Commons before it takes effect. The date at the top shows the latest version.
Contact
[COMPANY OR PERSON NAME], [COUNTRY]. Email [CONTACT EMAIL].