Privacy Policy

Last updated July 11, 2026

InitRepo is a product of Mass Traffic LLC ("InitRepo", "we", "us", "our"), which operates the website at initrepo.com and the InitRepo service. This policy explains what personal data we collect, why we collect it, how we use it, and your rights regarding it. We've written it to be read, not filed away.

By using InitRepo you agree to the collection and use of information as described here. If you have questions at any point, email privacy@initrepo.com.

What we collect and why

Account information

When you sign up, our authentication provider (Clerk) collects your email address and, if you use OAuth, your name and profile picture from the provider you choose (Google, GitHub, etc.). We use this to identify your account, send you account, onboarding, and (where permitted) promotional emails (see Email communications), and associate your projects with you.

Project content

When you run a project through the wizard, we store your answers to the questionnaire and all eight generated planning deliverables on our backend (Convex). This content is used solely to generate your documents and to display them in your dashboard. We do not use your project descriptions or generated documents to train AI models, and we do not share them with third parties except as required to operate the service (see Third-party services below).

Billing information

If you subscribe, your payment is processed by Stripe via our billing provider Autumn. We never see or store your card number — Stripe handles all payment data and stores it under their PCI-compliant systems. We store your subscription status, plan type, and the customer identifier that links your InitRepo account to your Stripe record.

Usage and analytics

We use PostHog to understand how InitRepo is used: which pages are visited, which features are used, and where people run into problems. PostHog collects standard web analytics data (page views, click events, session length, rough geographic region, browser type). This data is linked to an anonymous identifier, not directly to your email address.

Technical data

Our hosting provider (Vercel) and backend (Convex) automatically log standard request data: IP addresses, request timestamps, HTTP method and path, and response codes. This data is used for security monitoring, debugging, and service reliability. It is retained for 30–90 days depending on the provider.

Email communications

We send email from notifications.initrepo.com through our email provider, Resend (see Third-party services). There are three kinds:

  • Transactional — account and billing messages such as sign-in, password reset, receipts, and important service notices. These are necessary to operate your account, so they go to all users and are not subject to marketing opt-out.
  • Onboarding and lifecycle — a short series of messages after you sign up that help you get started and, for free accounts, may include a time-limited upgrade offer. We send these on the basis of our legitimate interest in helping you use a product you signed up for. Every one carries a one-click unsubscribe link, and opting out stops them.
  • Promotional — broader product news, tips, and offers beyond onboarding. We send these only to people who have explicitly opted in, and you can withdraw that consent at any time.

To stop marketing email, click "unsubscribe" in any such message — no sign-in required — or email privacy@initrepo.com. We honor opt-outs across all marketing and lifecycle email; only strictly transactional account messages continue. We do not sell your email address or share it for others' marketing.

Third-party services

Running InitRepo requires us to share certain data with the following third-party services. Each operates under their own privacy policy and data processing terms.

  • Clerk (clerk.com) — authentication and session management. Stores your email address and OAuth profile data. Data is held in Clerk's US-based infrastructure.
  • Stripe (stripe.com) via Autumn (useautumn.com) — payment processing and subscription management. Stripe processes and stores your payment card details under PCI DSS compliance.
  • Google Cloud / Gemini API — AI document generation. Your project questionnaire answers are sent to Google's Gemini API to generate planning documents. Per Google's API usage policies, data submitted via the API is not used to train Google's models.
  • Convex (convex.dev) — backend database and serverless functions. Stores your account details, project content, and generated documents. Convex operates on AWS infrastructure in the United States.
  • PostHog (posthog.com) — product analytics. Receives anonymized usage events and session data. Data is held on PostHog's US-based infrastructure.
  • Resend (resend.com) — email delivery. Receives your email address and the contents of the messages we send you (transactional, onboarding, and any promotional email you opted into). Resend operates on US-based infrastructure.
  • Vercel (vercel.com) — web hosting and CDN. Processes request data as part of serving the application.

We do not sell your data to any third party. We do not share your project content with advertisers, data brokers, or any party outside of the list above.

Cookies

We use two categories of cookies:

  • Strictly necessary — authentication session cookies set by Clerk. These are required for you to stay signed in. They cannot be disabled without breaking sign-in.
  • Analytics — cookies set by PostHog to track anonymous usage sessions. You can opt out of PostHog tracking by enabling "Do Not Track" in your browser, or by contacting us to have your identifier excluded.

We do not use advertising cookies or third-party tracking cookies.

Data retention

We retain your account and project data for as long as your account is active. If you delete your account, we delete your account data, project questionnaire answers, and generated documents within 30 days.

If an account is completely inactive for 24 consecutive months, we automatically and permanently delete all project questionnaire answers, context configurations, and AI-Generated documents associated with it — to protect your privacy and minimize how much data we store. We retain core account profile data (such as your name, email address, and account creation date) so that you can reactivate your account in the future and so we can send you updates about future product enhancements or launches, unless you explicitly choose to delete your account entirely.

Billing records may be retained longer as required by financial regulations. Anonymized analytics data is retained per PostHog's standard retention schedule. Server and technical log data is automatically retained for a period of 30 to 90 days before deletion.

Your rights

You can access and export your generated planning documents at any time from your dashboard using the ZIP download feature. You can delete your account from the Account page, which removes your data as described above.

If you are in the European Union or United Kingdom, you have additional rights under the GDPR and UK GDPR: the right to access, correct, or erase your personal data; the right to restrict or object to processing; and the right to data portability. To exercise any of these rights, email privacy@initrepo.com and we will respond within 30 days.

Children

InitRepo is not directed at children under 13. We do not knowingly collect personal data from anyone under 13. If you believe we have inadvertently collected such data, please contact us and we will delete it promptly.

Changes to this policy

We may update this policy as the service evolves. When we make material changes, we will update the date at the top of this page and, where appropriate, notify you by email. Continued use of InitRepo after a policy update constitutes acceptance of the revised policy.

Contact

Questions, requests, or concerns about this privacy policy: privacy@initrepo.com.