Last updated 19 October 2026

Privacy

donelog keeps a private record of your engineering work, and it is built so that the sensitive part, your code, never reaches us. This page says exactly what does, where it lives, who else handles it, and how to have it deleted.

What stays on your laptop

The donelog CLI runs on your own machine. None of this leaves it for donelog:

• Your GitHub credential. The CLI reads GitHub through the gh CLI you are already signed into. We never see the token.
• Your code, diffs and pull request descriptions. They are read on your laptop and are not sent to us.
• The analysis. With analysis on, the CLI hands that material to Claude Code on your laptop, which sends it to Anthropic under your own Claude account and its terms, not ours. donelog is not a party to that exchange; it receives only what comes out of it.

What we keep

• Your account: the ID our sign-in provider gives you.
• Your record. For each pull request or review worth keeping: its repository and number, its title, its dates, the GitHub handles of the people involved, why it was flagged, the note your Claude wrote about it and how significant it judged it. Every value is a short piece of text or a number; our server refuses anything larger.
• What we work out from it: the ranking of your evidence, the lapses it shows and the quarterly reviews written from it. Reviews are written on our server by our own code. No third party reads your record to write them.
• Your machines. For each laptop that syncs: an identifier derived from its hostname, the hostname itself so you can tell your machines apart, its operating system and the CLI version.
• Sync history: when each sync happened, how much it sent, and where the next one should carry on from.
• Which days you used it: for each day, whether you used the app or the CLI, and whether the app showed you a written review or you exported one. Nothing about what you looked at, and no third-party tracker. It is how we see whether the beta works for the people trying it.

What we don’t collect

No code, diffs or descriptions, and no GitHub token. No advertising networks, no cross-site tracking, and nothing sold or rented to anyone. Nothing in your record is shown to your employer, your manager or anyone else, and there is no feature that shares it. You can export a review as Markdown; what you do with that file is up to you.

Cookies

This site sets no cookies and writes nothing to your browser. The app at app.donelog.dev uses the cookies our sign-in provider needs to keep you signed in, and nothing else. If we turn on analytics for this site it will be Plausible, which is aggregate and cookieless: page views, referrers and countries, with no identifier that could single you out.

Why we’re allowed to hold it

To provide the service you signed up for: your record exists because you asked us to keep it. For securing the service, preventing abuse and counting visits to this site in aggregate, our legitimate interest in running it properly.

Who else handles it

Only the services that make donelog work, each processing data on our instructions and for no purpose of its own:

• Clerk, for sign-in, which is through GitHub. It holds the email address, name and GitHub account you sign in with.
• Railway, which hosts this site, the app, our API and the database your record lives in.
• Plausible, if analytics is on, for the visit counts above.

These providers may process data outside your country, including in the United States.

How long we keep it

• Your record and the reviews written from it: for as long as you keep your account.
• Where your syncs have reached: up to five years, so that a new laptop carries on instead of starting over.
• The log of individual syncs: 90 days.
• Which days you used it: for as long as you keep your account.

When your account is deleted, we delete everything stored under it. Copies in our database backups are deleted when those backups expire.

donelog is in beta. If we ever have to reset it, everything stored in it is deleted, including your notes and reviews; syncing again rebuilds the rest of your record from GitHub.

What you can ask us to do

Ask for a copy of what we hold, correct it, delete your account and everything in it, or object to us holding it at all. There is no self-serve deletion yet, so write to privacy@donelog.dev from the email address on the GitHub account you sign in with, and we’ll act within 30 days. To stop a laptop sending anything, run donelog dev reset --yes on it, which removes the link and everything donelog keeps on that machine.

If you are in the UK or EU and think we’ve got this wrong, you can complain to your national data protection authority.

Changes

If this notice changes in a way that affects you, we’ll email you rather than quietly updating the page.