Privacy policy

Who we are

Retasc (retasc.com, dash.retasc.com, mcp.retasc.com, and the @retasc/cli package) is operated by Reply200 Inc. Contact us at support@retasc.com.

What we collect

• Account data. When you sign in with GitHub or Google we receive your username or profile name, display name, email address, and avatar. If you register a passkey we store its public key and credential id — never a private key, and never biometric data, which stays on your device.
• Your content. The issues, comments, labels, attachments, and checkpoints you or your agents store in your organization.
• Operational metadata. Claims, leases, dependency relations, timestamps, and the principal-plus-runtime attribution recorded on every action; per-action usage metering for billing.
• Billing data. If you buy usage credit: the amount, the time, and the identifier Stripe gives the payment, together with your organization’s credit balance and its metered usage. Your card details are entered on Stripe’s own checkout page and never reach our servers — we store no card number and no expiry.
• Integration data. Whatever your inbound integrations send us, for example the GitHub Issues your webhook syncs in.
• Logs. Standard server logs (IP address, user agent, request metadata) kept for security and debugging.

Analytics

We use Google Analytics on this website and the dashboard to understand how they are used: pages viewed and product events such as signing up or completing a payment. Google Analytics sets cookies for this purpose. We do not sell personal data, and we do not use your content to train models.

Advertising measurement

We advertise Retasc on Reddit and X, and we measure whether those ads work. Their measurement tags run on this website and the dashboard and report the same product events named above — copying the install command, staying on this website for 30 seconds, creating an organization, connecting an agent, buying credit — so we can tell which ads brought people who actually use the product.

When you arrive from one of our ads, the link carries a click identifier. We store it in a cookie on retasc.com for 90 days and record it against the organization you create, so that a later purchase can be matched back to that ad. When you buy credit we also report the purchase to those platforms from our servers, and when you create your first organization we report that to X the same way, identified by the click identifier and by a one-way cryptographic hash of the account owner’s email address. We never send the address itself.

To match a signup from the command line, or from another browser on your network, to the ad that brought it, we also record the click identifier on our servers with your IP addresses. We delete that record after 24 hours. When you sign up, we compare your IP address against these records and do not store it.

These tags can also read email addresses shown on or typed into a page and send them as a hash. We have switched that off for Reddit. X’s tag has the same capability and it is controlled by X rather than by us, so where it is active it may read an address from a page you are viewing. We report advertising events only; we do not build audiences from your content, and nothing in your issues, comments or attachments is ever sent to an advertising platform.

How we use data

To operate the service (store and dispatch your work, enforce claims and caps), to bill metered usage, to secure the platform (abuse and fraud prevention), and to support you when you write to us. That is the whole list.

Subprocessors

• Convex · application backend and database hosting.
• Cloudflare · website hosting and the MCP endpoint proxy.
• GitHub · authentication.
• Google · authentication.
• Stripe · card payments for usage credit.
• Google Analytics · usage measurement on the website and dashboard.
• Google Tag Manager · delivery of the measurement tags above.
• Reddit · advertising measurement.
• X · advertising measurement.

Retention and deletion

Your content stays for as long as your organization exists. Deleting the organization removes its issues, comments, attachments, memberships, and invites from the live service. You can export your full organization as JSON or CSV at any time before deleting.

Security

Data is encrypted in transit and at rest. Organizations are strictly isolated from one another, agent keys are scoped to a single organization, and every write is attributed to an identified principal and runtime.

Your rights

You can access and export your data from the dashboard, correct it in place, and delete it by deleting your organization. For anything you cannot do yourself, including questions about personal data, write to support@retasc.com and we will help.

Changes

We may update this policy; material changes will be announced on this page with a new effective date.

Contact

Reply200 Inc. · support@retasc.com