Privacy Policy

What we collect

• Account data: the email address, display name and avatar your sign-in provider returns, plus the provider’s own stable user id, your workspace membership and your role in it.
• Session records: a hash of your session token, the browser user agent, and a hash of the IP address the session started from, so the sessions list can tell one device from another.
• Repository data: when you connect the GitHub App, the account it is installed on and, for the repositories you select, the routes, page files, layouts and stylesheet tokens a scan reads. We store what a scan found, not a copy of your source tree.
• Site data: when you point Remixing at a deployed URL instead of a repository, the sitemap and the rendered HTML of the public pages we fetch, reduced to the routes and titles the picker shows you.
• Content you upload: logos, screenshots and other images in your asset library, and the brand colours read from your project or set by hand.
• Reels and renders: the reel documents you edit, their version history, and the video files rendered from them.
• Usage data: which repositories are connected, how often scans and renders run, and an audit log of workspace actions such as invites, role changes and connections.

Incidental data

OAuth callbacks and GitHub webhooks carry data we receive but do not set out to keep, such as installation identifiers, provider avatars, hosted domain hints and event metadata. It flows through the service to complete the request and is not retained beyond what the operation needs.

What we don’t collect

Repositories you have not connected, and files outside the ones a scan reads. Remixing does not clone your history, read your issues or pull requests, or store your source files: it reads the page, layout and stylesheet files it needs to describe a surface, and keeps the description. Sites are fetched only when you give us the URL, and only the public pages a sitemap lists.

How we use it

To run the product: discovering the pages in a project you connected, building and versioning reel documents, rendering video, serving share links, and keeping workspace membership and billing in order. On our public marketing pages we also measure visits with Google Analytics, to learn which parts of the site help people decide. Analytics never runs inside a workspace. We do not sell your data or share it with third parties for advertising.

Third-party processors

Remixing talks to a few other services. Each one is tied to something you turned on, except analytics on our public pages, listed last.

• GitHub: read requests for the repositories you select, made with a short-lived installation token minted per request. We store the installation, never a long-lived repository token.
• Google: sign-in only, when you choose to sign in with Google.
• Cloudflare R2: object storage for rendered videos and uploaded assets, served back through signed URLs that expire.
• Your own site: when you point Remixing at a deployed URL, we fetch its sitemap and a small number of public pages from it. Nothing is sent to that host beyond the read requests themselves.
• Google Analytics: page views and clicks on our public marketing pages, such as which button you pressed or which video format you tried. It loads nowhere else. Visitors in the EU, UK and Switzerland get no analytics cookies; Google receives cookieless pings instead. Advertising features are off for everyone.

Google user data

Your Google account is used for one thing: signing in. The request asks for openid, email and profile, which is your Google account id, your email address and its verification state, your name and your avatar. We request no other Google scopes at any point.

Remixing reads no Google product. It does not touch Gmail, Drive, Calendar, Contacts or any other service on your Google account, and it never writes anything to Google. What sign-in returns is stored per workspace, is never pooled across customers, and is never combined with another workspace’s data. Where your Google account carries a Workspace domain, we keep that domain so the next person from your company joins your workspace rather than starting a second one.

Google user data is used solely to identify you and to place you in the right workspace. We do not sell it, we do not use it for advertising, we do not transfer it to third parties, and we do not use it to develop, improve or train generalized models. No human at Supertype reads it except with your explicit consent, for example when you ask us to investigate a support issue, where required for security, or to comply with applicable law.

You can revoke access at any time from your Google account permissions page. Remixing’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

GitHub data

Two GitHub connections exist, and both are optional. Signing in with GitHub reads your account id, email and avatar, and the list of installations you can reach, which is how a claim on an installation is checked rather than believed.

The GitHub App reads repository contents for the repositories you pick during installation, and nothing else. Access is read-only: Remixing opens no pull requests, files no issues, and writes no commits. You can narrow the selected repositories or uninstall the App from your GitHub account settings, which revokes our access immediately.

Data retention

Workspace data is retained while your workspace is active. Deleting a reel removes its versions and renders, and deleting a workspace or your account starts a job that removes the rows and the stored objects behind them within 30 days. Revoking the GitHub App stops all repository access at once. You can request immediate deletion by emailing us.

Security

Data is stored in a hosted PostgreSQL database with encryption at rest and in transit, and every table that belongs to a workspace is scoped by tenant with row level security behind it. Session tokens are stored as hashes, never in the clear. Renders and assets live in a private bucket and are served through signed URLs that expire, so a stored key is not a public file. Access is restricted to the Supertype engineers who need it to operate the service.

Your data rights

You have the right to access, transfer, and delete the data Remixing holds about you and your workspace.

• Access: Request what data we hold for your workspace via email.
• Transfer/portability: Request your data in a machine-readable format (JSON). Reel documents are already JSON and can be exported from the editor.
• Deletion: Delete a reel, a workspace or your account from the product, or email us for immediate deletion.
• Legal rights: If you are in the EU or California, you may have additional privacy rights under GDPR, CCPA, or similar laws. Contact us to understand your options.

Contact

For questions, data access requests, deletion requests, or GDPR/CCPA privacy rights: [email protected]