Last updated: 8 November 2026

Privacy policy

This policy explains how TecMinds GmbH handles personal data for gespann.app, Gespann Cloud and the gespann sync command. It follows the Swiss Federal Act on Data Protection (FADP) and, where it applies, the EU General Data Protection Regulation (GDPR).

1. Controller

Write to this address with any question about data protection.

2. The CLI

The open source CLI reads your git history, your agent instruction files and local agent transcripts on your own machine. It redacts secrets and writes its results into your repository. It does not send any of this to us.

If you let the CLI use a language model, it calls the model tool installed on your machine, such as claude -p or codex exec, under your own account with that provider. Those calls do not pass through us. The provider’s privacy policy applies to them.

3. What gespann sync sends

When you run gespann sync with an API key, the CLI sends this metadata to Gespann Cloud:

• mistake ids, hashed on your machine with a key that belongs to your account (ids of built-in rules, such as cmd-gh-watch, stay readable), with their kind, counts, and the days they were first and last seen;
• repo totals: number of commits, fix commits, reverts, agent sessions and incidents;
• guardrail ids, their kind, and whether each check passed;
• how often each guardrail blocked an agent, per day;
• the CLI version and the time of the sync;
• a hash of the repository. Only if you pass --names: the repository name and readable mistake ids, which can contain file or command names.

It never sends code, transcripts, prompts, file paths or commit messages. Our server rejects any field that is not on this list. gespann sync --dry-run prints exactly what would be sent and sends no scan data. When you are logged in, it only fetches your account’s hash key first.

We use this data to show you your history, to send your weekly report on paid plans and, for Team plans, to show it to the members of your team. The legal basis is the performance of our contract with you (Art. 6(1)(b) GDPR).

4. Your account

To create an account we store your email address. We use it to send you login links, the weekly report if your plan includes it, and important notices about your account or the service. We also store your plan, your API keys (as hashes only) and, for Team plans, which accounts belong to the team.

5. Payments

Payments are processed by Dodo Payments, who sell the subscription as merchant of record. They collect and process your payment details, such as card data and billing address, under their own privacy policy. We never see your card details. From Dodo Payments we receive the email address you paid with, your plan, the number of seats, the subscription status and the renewal date.

6. Email

We send transactional email (login links, reports, notices) through Resend. Resend receives your email address and the content of the message to deliver it. We do not send newsletters or marketing email.

7. Hosting and logs

The website and Gespann Cloud run on a server in Germany, rented from Hetzner Online GmbH, Industriestrasse 25, 91710 Gunzenhausen, Germany.

The domain gespann.app uses Cloudflare, Inc. (USA) for DNS, and Cloudflare may sit in front of the server as a proxy. It then processes your IP address and the request to deliver and protect the site, under its own privacy policy.

When you visit the site, the server processes technical data such as your IP address, the time, the page requested and your browser. It needs them to deliver the page and to protect the service against abuse. We keep these logs only as long as needed for that purpose. The legal basis is our legitimate interest in a secure service (Art. 6(1)(f) GDPR).

8. Cookies

We set one cookie: a session cookie that keeps you logged in. It is only set when you log in. We use no tracking cookies, no analytics and no advertising tools, and we embed no third-party content.

9. Transfers abroad

Dodo Payments and Resend may process data outside Switzerland and the EU, including in the USA. Where they do, we rely on a certification under the Data Privacy Framework (Swiss-U.S. and EU-U.S.) where available, or on the standard contractual clauses.

10. How long we keep data

• When you delete your account on your account page, we delete your account data, API keys and synced history at once. When a paid plan ends without renewal, your account becomes a free account: we keep the full history for 30 days, then delete history older than 14 days.
• While a plan runs, synced history is kept for 14 days on Free, 12 months on Pro, and on Team until you delete the account.
• On the free plan, synced history older than 14 days is deleted automatically.
• Records we must keep by law, such as business records, we keep for the statutory period of 10 years (Art. 958f Swiss Code of Obligations). Invoices are issued and kept by Dodo Payments.

11. Your rights

You can ask for access to your personal data, and for its correction, deletion or a copy. You can object to processing and withdraw consent. Write to [email protected].

You can lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC). If you live in the EU, you can also contact the supervisory authority in your country.

12. Changes

We update this policy when our processing changes. The version published here applies.