Privacy Policy
Last updated: July 8, 2026
Thank you for using ShowProgress.app ("we," "us," or "our"). This Privacy Policy outlines how we collect, use, process, and protect your personal and non-personal data in connection with our website located at https://showprogress.app (the "Website") and the B2B SaaS platform services we provide (the "Services").
By accessing or using our Website and Services, you acknowledge that you have read and understood this Privacy Policy.
1. Identity of the Data Controller
The data controller responsible for your personal data under the General Data Protection Regulation (GDPR) and other applicable data protection laws is:
Fidel Echevarria
Email: legal@showprogress.app
2. Information We Collect
We collect and process the following categories of data to provide, maintain, and improve our services:
When you register for an account, we collect your email address, name, and profile picture. Authentication is securely managed and hosted via Supabase.
To sync your development activity, you explicitly connect your GitHub account. We collect and store encrypted GitHub Personal Access Tokens (PATs) or OAuth tokens, along with connected repository names, commit messages, and pull request metadata. We do not write to your repositories or read code beyond listing commit metadata and diffs for release summaries.
If you connect your Twitter/X account, we store the OAuth tokens and handles required to publish drafts on your behalf.
Payment processing is handled securely by Stripe. We do not store your credit or debit card details on our database servers. Stripe provides us with billing history and subscription status data.
We store content submitted on the customer feedback boards (feedback titles, descriptions, tags, upvotes) and media assets (images, screenshots, videos) uploaded to enrich your release workspace.
We use cookies, IP addresses, browser types, and device configurations to analyze usage patterns, optimize site speed, and protect against fraudulent activities.
3. Legal Basis for Processing under GDPR
We process your personal data under the following legal bases:
Performance of a Contract: Processing is necessary to deliver the Services you subscribed to, including syncing GitHub events, generating release content, and hosting feedback boards.
Consent: For using non-essential cookies, receiving marketing materials, or connecting third-party platforms (GitHub, Twitter/X).
Legitimate Interests: For analyzing platform usage to improve features, maintaining platform security, and preventing abuse.
Legal Obligation: For retaining invoicing and financial transaction history to comply with tax regulations in Spain.
4. Data Sharing and Subprocessors
We do not sell, trade, or rent your personal data. We share your information with trusted third-party subprocessors who assist us in hosting, billing, communication, and AI generation:
Supabase Inc.: Used for application database hosting, asset storage, and secure user authentication.
Stripe Inc.: Used for subscription billing and payment processing. We do not store financial card data directly.
Resend Inc.: Used to send transactional emails, account notifications, and marketing communications.
Google Gemini Enterprise Agent Platform: Used to generate release notes and social media drafts. Your git summaries and developer notes are processed securely. Google does not use customer data to train its foundational or global AI models.
5. International Data Transfers
Some of our subprocessors are located outside the European Economic Area (EEA), primarily in the United States. To ensure that your personal data receives an adequate level of protection, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, and verify that our vendors adhere to strict data security standards.
6. Data Retention
We retain your personal data for as long as your user account is active, or as necessary to provide you with our Services. If you delete your account, we will erase or anonymize your data within 30 days, except for billing logs and transactional histories that we are legally required to retain for tax and regulatory purposes in Spain (typically up to 5-10 years).
7. Your GDPR Data Rights
As a European resident, you hold the following rights under the GDPR regarding your personal data:
• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Ask us to correct inaccurate or incomplete data.
• Right to Erasure (Right to be Forgotten): Request the deletion of your personal data under certain conditions.
• Right to Restrict Processing: Request that we limit the processing of your data.
• Right to Data Portability: Request to receive your data in a structured, machine-readable format.
• Right to Object: Object to the processing of your data, including direct marketing.
• Right to Withdraw Consent: Withdraw your consent at any time for consent-based processing.
To exercise any of these rights, please email us at legal@showprogress.app. We may verify your identity before responding. If you believe we process your data unlawfully, you have the right to lodge a complaint with a supervisory authority, such as the Spanish Data Protection Agency (AEPD).
8. Children's Privacy
Our Services are not designed for or targeted at children under the age of 16. We do not knowingly collect personal data from children. If we learn we have inadvertently collected data from a child under 16, we will take immediate steps to delete it.
9. Changes to this Privacy Policy
We may update this Privacy Policy from time to time. If we make significant changes, we will notify you by email or via a prominent announcement on our platform prior to the change taking effect.