Privacy Policy

1. Introduction & Merchant Identity

This Privacy Policy explains how RewindGit Operations ("we", "us", or "our"), operating the software platform RewindGit (accessible at rewindgit.com), collects, uses, stores, and protects your personal and technical data when you use our SaaS service. We are dedicated to respecting your privacy and adhering to applicable data protection laws, including the Digital Personal Data Protection (DPDP) Act, 2023 and the Information Technology Act, 2000 of India.

2. Information We Collect

When you register and use RewindGit, we may collect the following categories of information:

• GitHub Profile & OAuth Data: Your GitHub username, primary email address, public profile avatar, and unique GitHub user ID provided through GitHub OAuth authorization.
• GitHub Access Tokens: Encrypted OAuth access tokens required strictly to create authorized repositories and push generated source code and commit trees to your GitHub account.
• Project & Generation Configurations: Your selected tech stack, project ideas, difficulty levels, commit style preferences, and date ranges.
• Payment & Transaction Details: When you purchase credits, transaction identifiers (such as Razorpay Payment ID, Order ID, payment timestamps, and amount paid) are collected. We do NOT store credit/debit card numbers, CVVs, expiry dates, or banking passwords. All sensitive payment processing is executed directly by Razorpay under PCI-DSS Level 1 compliance.
• Technical Telemetry: Log data, IP addresses, browser user-agent, and error reports to maintain platform stability and detect malicious intrusion attempts.

3. Purpose and Legal Basis for Processing

We process your personal information for the following legitimate purposes:

• To authenticate you and maintain your authenticated session.
• To execute AI-assisted code generation inside isolated sandboxes and push completed repositories to your GitHub account.
• To process credit purchases and maintain an accurate account ledger.
• To transmit essential transactional communications (payment receipts, generation completion alerts).
• To troubleshoot technical failures and prevent service abuse or security breaches.

4. Payment Processing with Razorpay

We use Razorpay Software Private Limited ("Razorpay") as our third-party payment gateway partner for processing online payments in Indian Rupees (INR).

When you proceed to checkout, you are redirected to or interact with Razorpay's secure checkout interface. Razorpay adheres strictly to RBI guidelines, data localization mandates, and tokenization standards. Your payment card information is tokenized and stored securely by Razorpay and participating card networks. For more details on Razorpay's privacy practices, you may review Razorpay's Privacy Policy.

5. Data Security Measures

We implement robust administrative, technical, and physical safeguards to protect your personal information:

• All data in transit is encrypted using modern TLS / HTTPS (256-bit encryption).
• GitHub access tokens are encrypted at rest using industry-standard AES-256-GCM encryption.
• Temporary cloud sandboxes (Daytona, E2B, Modal) used during project builds are isolated and completely purged and destroyed upon generation completion.
• Regular automated vulnerability and dependency audits to prevent security regressions.

6. Third-Party Service Providers

We work with trusted third-party cloud infrastructure providers strictly to deliver our SaaS service:

• Cloud Database & Auth: Neon Postgres with Better Auth for encrypted user data storage.
• Payment Gateway: Razorpay for secure INR transactions.
• AI Inference APIs: OpenRouter / Bhaskara for code synthesis (source code prompts only; no personal data transmitted).
• Cloud Sandboxes: Daytona & E2B for containerized builds and test runners.
• GitHub API: For creating repositories and pushing commits on your behalf.

7. Data Retention & Deletion Rights

We retain your account data for as long as your account remains active. You maintain full rights to:

• Request access to the personal data we hold about you.
• Request correction or rectification of inaccurate details.
• Request permanent account deletion and erasure of your stored tokens from your Dashboard > Settings or by emailing our support desk.

* Note: Transactional billing records may be retained for statutory periods as mandated by Indian tax and financial accounting regulations.

* After an account is deleted we keep only a one-way keyed hash of the GitHub account ID (not your name, email or username), together with which promotional coupons were already used. It cannot be reversed into your identity and is used solely to stop the welcome bonus, referral bonus and single-use coupons from being claimed again by re-creating an account.

8. Cookies Policy

We only employ strictly essential HTTP-only cookies necessary for session authentication and CSRF security. We do not use intrusive third-party cross-site advertising trackers.

9. Grievance Officer & Contact Details

In compliance with the Information Technology Act, 2000 and the Consumer Protection (E-Commerce) Rules, 2020, the details of our Grievance Redressal Officer are published below: