Privacy Policy

To create an account we collect a username, an email address, and a password (kept only as a salted hash). You may optionally add a display name and avatar. If you sign in with GitHub instead, we receive your GitHub username, user ID, and associated email to identify you — we request identity scopes only (read:user user:email), never repository access.

When you push repositories to Oak, we store your code, commit history, branch metadata, and associated content (blobs, manifests). This data is stored on our servers to provide the version control service.

We collect basic usage information including:

• IP addresses and request metadata (timestamps, endpoints accessed)
• CLI version and platform information sent with API requests
• Repository names, branch names, and operation types (push, pull, etc.)
• Error logs and crash reports

Our servers automatically log HTTP requests, including IP addresses, user agents, request paths, and response codes. These logs are used for debugging, security monitoring, and service improvement.

Paid plans are billed through Stripe, our payment processor. When you subscribe, Stripe collects and processes your payment-card details directly — we never see or store full card numbers. We retain a Stripe customer and subscription identifier, your billing email, and your plan and seat count so we can operate your subscription.

If you connect GitHub to import a repository, we use a short-lived, read-only installation token scoped to the repositories you select, solely to copy the code you choose to import into Oak. We do not request write access, and you can revoke the connection from your GitHub settings at any time.

We use collected data to:

• Provide and operate the Oak service (storing and syncing your code)
• Maintain and improve service reliability and performance
• Debug issues and respond to support requests
• Detect and prevent abuse, fraud, and security threats
• Generate aggregate, anonymized usage statistics

We do not sell your personal data or code to third parties. Oak itself does not train machine learning models on your code. We do not share your code with third parties except as required to operate the service (e.g., cloud infrastructure providers).

No AI calls on your behalf. Oak does not send your code, branch names, diffs, or any other repository content to AI providers, and makes no AI calls on your behalf.

Email. We send account, security, and billing notices through Resend, our email provider — these are required to operate your account. We may also send occasional product updates; every such message includes an unsubscribe link, and opting out does not affect required account email.

Any other coding agent you run alongside Oak (Claude Code, Cursor, GitHub Copilot, etc.) is a separate integration with its own privacy posture; treat what you put into those tools accordingly. Oak only sees the code those agents commit and push.

Your data is stored on servers hosted by third-party cloud infrastructure providers. We use industry-standard security practices including encrypted connections (TLS) for data in transit. However, as an experimental service, we cannot guarantee the same level of security as established production platforms.

Important: Because Oak is experimental, we strongly recommend maintaining independent backups of any code you store with us. We are not responsible for data loss.

We retain your code and repository data for as long as your repositories exist on the service. Server logs and usage data are retained for up to 90 days for operational purposes.

If you stop using the service, we may delete inactive repositories and associated data after a reasonable period of inactivity. We will make reasonable efforts to notify users before deleting data, but cannot guarantee advance notice during the experimental phase.

The Oak CLI runs locally on your machine. It:

• Reads and writes files only within Oak-initialized repository directories
• Stores local repository data in a .oak directory within your project, or in a local mount cache under ~/.oak/mounts/ when you use oak mount
• Sends your code to Oak servers only when you explicitly publish it (for example oak push, oak commit --push, or finishing a mount)
• Sends your CLI version and platform with API requests for compatibility purposes
• Does not collect telemetry or analytics beyond what is described above

When you sign in, Oak sets a single strictly-necessary first-party cookie to keep you logged in (plus a short-lived cookie during the GitHub sign-in handshake). These are essential to operate the service, are not used for advertising, and require no consent.

For website analytics we use Plausible Analytics, a privacy-friendly tool. Plausible does not use cookies, does not collect personal data, and is fully compliant with GDPR, CCPA, and PECR. All data is aggregated and no individual visitors can be identified. We use no other third-party tracking scripts.

We rely on a small set of third-party providers to operate Oak. They process data only as needed to deliver the service, under their own privacy terms:

• Amazon Web Services — cloud compute hosting (United States)
• PlanetScale — managed database for account and repository metadata
• Cloudflare — object storage (R2) for your code, plus CDN/edge delivery
• Stripe — payment processing for paid plans
• Resend — transactional and product-update email
• GitHub — optional sign-in and repository import, only if you connect it
• Plausible — privacy-friendly, cookieless website analytics

Our infrastructure is currently hosted in the United States. If you access Oak from outside the U.S., your data is transferred there to provide the service.

You have the right to:

• Access your data — your code is always accessible via oak pull
• Delete your data — contact us to request deletion of your repositories and account data
• Export your data — pull your repositories locally at any time, or use oak export to replay history into a fresh git repo

To exercise these rights or ask questions, email [email protected].

Oak is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal data, please contact us so we can delete it.

We may update this privacy policy from time to time. We will update the "Last updated" date at the top of this page. Continued use of the service after changes constitutes acceptance of the updated policy.

Questions about this policy? Email [email protected].