Privacy Policy

In this policy, "we" and "us" mean the operator of Gamify. For the purposes of the UK GDPR and the EU GDPR, we are the data controller for the personal data described in this policy.

This policy covers the Gamify web application, its public read API, the embeddable leaderboard, and the connectors that let an AI assistant such as Claude use Gamify on your behalf. If you have any question about it, write to gamifysaas@gmail.com.

We collect only what the product needs in order to work. That is:

• Account details. Your email address, the display name you choose, and your password. Passwords are handled entirely by our authentication provider and are stored only as a salted hash — we never see or store the password itself.
• Workspace membership. Which workspace you belong to, whether you are an administrator of it, and — if you joined by invitation — which invitation you used and when.
• Connected accounts. When you connect a service, we store the access and refresh tokens it issues, your username or account identifier on that service, the permissions you granted, when it was last synced, and the error message from the last sync if it failed. Tokens are encrypted before they are written to the database. For a custom connector, we store only the identifier you type in, such as your username on that system.
• Activity data. The events we read from the services you connect — see the next section for exactly what this means.
• Scores derived from that activity. Your point transactions and the rule or adjustment behind each one, your current and longest streak, the badges you have earned, and the level those points add up to.
• What administrators set up. The app credentials an administrator enters so members can connect a service, such as an OAuth client secret or a custom connector's API key, encrypted like the tokens above. We also store the workspace's scoring rules and badges, and, for each invitation link, a hash of the link, its label, its limits, and who created it.
• API and embed keys. If an administrator creates one, we store a hash of the key, its name, who created it, and when it was last used. The key itself is shown once when it is created and never stored.
• AI assistant authorizations. If you connect an AI assistant to Gamify, our authentication provider records which assistant you approved and issues it an access token.
• Technical logs. Our hosting provider records standard server logs (IP address, timestamp, requested URL, user agent), and our authentication provider records sign-in and account events, including IP address. We use these for security and debugging.

We do not run advertising trackers, third-party analytics, or any profiling beyond the points, levels, and badges the product visibly exists to calculate.

Gamify works by reading activity from tools you already use and turning it into points. You choose which services to connect, one at a time, and you can disconnect any of them whenever you like.

We only read. We ask each service for the narrowest permissions it offers for reading your activity. We never post, comment, commit, create, or change anything on your behalf. Where a service can only grant broader access than that, we say so below.

For every event we store its type, when it happened, and its ID on the source service. We also store the specific fields listed below, and nothing else from the service's response. Scoring rules are checked against these fields, and keeping them lets us re-score your history if a rule changes, without asking the service for it again.

When you disconnect a service, we delete its stored tokens and all the activity we collected from it right away, and stop reading from it. Points you already earned from that activity stay on your balance, but the activity itself is gone. To remove those points as well, delete your account or ask us to — see your rights below.

• To create and maintain your account and sign you in.
• To read activity from the services you have connected and apply your workspace's scoring rules to it.
• To show you your points, level, streak, and badges, and to rank members of a team workspace on a leaderboard.
• To send you account email — confirming your address and resetting your password.
• To run the public read API and the leaderboard embed, if your workspace creates keys for them.
• To answer an AI assistant you have connected, within the permissions your account has.
• To keep the service secure, diagnose faults, and prevent abuse.

We do not sell your personal data. We do not share it with advertisers. We do not use it to train machine learning models.

This depends on the kind of workspace you are in, and it is worth being precise about.

In an individual workspace, you are the only member and its administrator. Nobody else sees your points, activity, or connected accounts unless you create one of the keys described below.

In a team workspace, every member can see every other member's display name, total points, and level on the shared leaderboard, along with the team's combined points. Administrators of that workspace can also see your activity history, including the stored fields described above; your individual point transactions; your streak and badges; which services you have connected; and the username you use on them. Administrators can adjust your points, make you an administrator or remove that role, and remove you from the workspace, which deletes your account. They cannot see your password or your connected-account tokens.

If your workspace creates an embed key, the leaderboard (display names, points, and levels) can be shown on any web page the key is placed on, including pages anyone on the internet can see.

If your workspace creates a secret API key, whoever holds it can read each member's display name, points, level, streaks, earned badges, and the type and time of their recent activity. The API never returns the stored fields of an event, such as a pull request title or a task's text.

If you connect an AI assistant, such as Claude, it can see whatever your account can see in Gamify. If you are an administrator, that includes the administrator view above, along with example values from members' stored activity. What the assistant's provider does with that data is covered by its own privacy policy, not this one. You can revoke an assistant at any time on the Claude / MCP page.

If you are in the UK or the European Economic Area, we rely on the following legal bases:

• Performance of a contract. Running your account, reading the activity you asked us to read, and calculating the scores that are the entire point of the service.
• Consent. You choose each service you connect, one at a time. For built-in services you approve it on that service's own authorization screen, and for a custom connector you approve it by entering your identifier. Connecting an AI assistant works the same way, through a consent screen. You can withdraw consent at any time by disconnecting the service or revoking the assistant.
• Legitimate interests. Keeping the service secure, preventing abuse, and diagnosing faults — balanced against your rights, and limited to what those purposes actually require.

We use a small number of service providers to run Gamify. Each processes data only on our instructions and only for the purpose listed:

• Supabase. Database, authentication, and account email (confirmations and password resets). Privacy policy
• Vercel. Application hosting, request logging, and the scheduled sync job. Privacy policy

We also exchange data with the services you personally connect, but only in the direction and to the extent you authorized: we read your activity from them, and we send them nothing about you beyond what is needed to ask for it, such as your account ID on that service.

If you connect an AI assistant, we send it the data it requests on your behalf. The company that runs the assistant is not our subprocessor; its handling of that data is governed by your agreement with it.

Beyond that, we disclose personal data only where we are legally required to, or where it is necessary to establish or defend a legal claim.

• Account details, points, streaks, and badges: for as long as your account exists.
• Connected-account tokens and the activity collected through them: until you disconnect that service, at which point both are deleted.
• Server and sign-in logs: kept by our hosting and authentication providers under their own retention schedules, and used only for security and debugging.

Deleting an account removes it and all its data from our database right away: your profile, connected accounts, activity, points, streaks, and badges. That happens when you ask us to delete it, or when a team administrator removes you. Copies in our providers' backups expire on their normal schedule, and in every case within 30 days, unless the law requires us to keep something longer.

You have the right to:

• Access the personal data we hold about you, and receive a copy of it in a portable format.
• Correct anything inaccurate — your display name is editable in the app, and we will correct anything else on request.
• Delete your account and the data associated with it.
• Withdraw consent for any connected service or AI assistant at any time, by disconnecting it under Connections or revoking it under Claude / MCP.
• Object to or ask us to restrict processing based on our legitimate interests.
• Complain to your data protection authority — in the UK, the Information Commissioner's Office.

You can disconnect a service yourself at any time from the Connections page. For account deletion, data access, or a data export, email gamifysaas@gmail.com from the address on your account and we will action it within 30 days. We do not charge for this.

• Connected-account tokens and administrator-entered credentials are encrypted at rest with AES-256-GCM, using a key held outside the database. A copy of the database alone does not yield a usable token.
• Workspaces are isolated at the database level by row-level security, so a query made on behalf of one workspace cannot return another workspace's rows even if the application asks it to.
• API keys and invitation links are stored as hashes, never in a form we could read back or reveal to anyone, including you.
• All traffic is encrypted in transit over HTTPS.

No system is perfectly secure, and we do not claim otherwise. If you believe you have found a vulnerability, please write to gamifysaas@gmail.com rather than disclosing it publicly, and we will respond as quickly as we can.

Gamify sets cookies for one purpose: keeping you signed in. These are strictly necessary — without them the application cannot tell one request from another — so they do not require a consent banner, and we do not show you one.

We set no advertising cookies, no analytics cookies, and no third-party tracking cookies of any kind. Your theme preference is stored locally in your browser and never sent to us.

Our infrastructure providers operate globally, so your data may be processed in a country other than your own, including the United States. Where data is transferred out of the UK or the EEA, it is covered by the transfer mechanisms those providers maintain, such as the European Commission's Standard Contractual Clauses.

Gamify is not intended for children. You must be at least 16 years old to create an account. If you believe a child has given us personal data, write to gamifysaas@gmail.com and we will delete it.

If we change this policy we will update the date at the top of this page. Where a change materially affects how we handle your data, such as a new category of data, a new purpose, or a new subprocessor, we will email account holders at least 30 days before it takes effect rather than relying on you to notice.

For any privacy question or to exercise any of the rights above, write to gamifysaas@gmail.com.

See also our Terms of Service.