Privacy Policy

This Privacy Policy explains what information ReleaseJam (the "Service") collects, how we use it, and the choices you have. We collect only what we need to run a release-notification service for you, and we never sell your personal information.

1. Information we collect

Account information. When you sign up we store your email address and, if you register with email and password, a salted cryptographic hash of your password — never the password itself. If you sign in with GitHub or Google instead, we receive your email, name, and avatar image from that provider (we request only basic profile and email access).

Subscriptions and preferences. The projects you subscribe to, the groups you organize them into, your notification frequency (immediate, daily, weekly, or monthly), and your theme preference.

Notification channels. The destinations you configure to receive notifications — email addresses, webhook URLs, and Slack or Discord endpoints. Sensitive channel credentials are encrypted at rest.

Imported files. When you import a dependency manifest (such as package.json or mix.exs), we parse it to identify the packages you depend on. We store the resulting subscriptions, not the raw file beyond what is needed to complete the import.

Operational data. Logs and records of notifications we send or attempt to send, used to avoid duplicate deliveries and to debug problems.

2. How we use information

• to authenticate you and maintain your session;
• to deliver the release and vulnerability notifications you ask for;
• to operate, secure, and improve the Service;
• to communicate with you about your account or important service changes.

3. Release and vulnerability data

To populate your feed, the Service fetches publicly available data from package registries and from the OSV.dev vulnerability database. This data describes public software projects, not you, and is aggregated independently of your account.

4. Sharing

We do not sell your personal information. We share information only:

• with service providers that host our infrastructure and deliver notifications on our behalf (for example, an email-delivery provider), under appropriate confidentiality obligations;
• with the notification destinations you configure — when you set up a webhook, Slack, or Discord channel, we send your release data to that destination at your direction;
• when required by law, or to protect the rights, safety, and security of users and the Service.

5. Cookies

We use a small number of first-party cookies, and no third-party advertising or tracking cookies:

• a signed session cookie that keeps you signed in and protects against cross-site request forgery;
• an optional signed "remember me" cookie, set only if you choose that option at sign-in, that keeps you signed in for up to 14 days;
• a theme cookie that remembers your light/dark preference.

6. Data retention

We retain your account information and subscriptions for as long as your account is active. When you delete your account, we delete or anonymize your personal information, except where we must retain limited records to comply with legal obligations or resolve disputes. Notification logs are kept only as long as needed for operational purposes.

7. Security

We use industry-standard measures to protect your information: passwords are stored only as salted hashes, sensitive channel credentials (such as webhook URLs and Slack or Discord tokens) are encrypted at rest, and traffic is encrypted in transit. No system is perfectly secure, but we work to safeguard your data and to limit access to it.

8. Your choices

• You can update your email, notification preferences, and channels in your settings.
• You can unsubscribe from any project at any time.
• You can delete your account, which removes your personal data as described above.
• Depending on where you live, you may have rights to access, correct, export, or delete your personal information. Contact us to exercise them.

9. Changes

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, provide additional notice.

10. Contact

Questions or requests about your privacy? Email us at support@releasejam.com.