Privacy Policy — Tetrad

Tetrad (the “Service”, “we”, “our”) is operated by an individual: Shkurko Daniil(the “Operator”).

What Tetrad does with your data, in one paragraph

Tetrad is a note editor that stores your notes in your own GitHub repositories. The bulk of your data — note texts, images, page structure — never lands on our servers and remains under your full control in your GitHub account. The sections below describe what little data we do touch and what we do with it.

What data we process

Sign-in data from GitHub

When you sign in to Tetrad through GitHub, we receive from GitHub:

Your numeric GitHub identifier (User ID).
Your GitHub login (username).
The primary email address associated with your GitHub account.
A link to your avatar image.

This data is stored in an encrypted session cookie in your browser (HttpOnly, not accessible to JavaScript). We use it to display your profile and to interact with the GitHub API on your behalf.

Service usage data (analytics)

We use two analytics services:

PostHog — collects anonymized navigation events (pages opened, clicks, errors). Linking to your GitHub login happens only after you sign in. The service is configured to work through our own proxy endpoint.
Vercel Analytics — collects technical page performance metrics (load time, Core Web Vitals).

Analytics are disabled in development environments and preview deployments.

Data stored in your browser

Tetrad stores the following on your device:

Cookies: the authentication session and your time format preference (12h / 24h).
localStorage: interface preferences, the deploy-state flag, and an emergency autosave flag.
sessionStorage: transient UI flags scoped to the current tab only.
IndexedDB: a cache of your note bodies for ⌘K search, your autosave drafts (a local copy of the content being edited, which protects you from data loss if your browser crashes), and a cache of GitHub avatar images.

This data does not leave your browser. We do not have access to it.

Note content

The text of your notes, your uploaded images, and the structure of your pages are stored exclusively in your GitHub repository. We do not copy them to our servers. Images are processed in your browser and committed directly to GitHub.

Server logs

The Vercel platform on which Tetrad runs automatically maintains technical logs: your IP address, request headers, the time of the request. These logs exist for debugging and to ensure the service is operable. We do not use them to track you.

Why we process this data

Authentication and acting on GitHub on your behalf — using your GitHub User ID, login, email, and access token.
Displaying the interface — your login, email, and avatar are used to render your profile inside the app.
Searching the content of your notes — through the IndexedDB cache on your device.
Protecting against draft loss — through the IndexedDB autosave cache on your device.
Improving the product — through anonymized analytics from PostHog and Vercel Analytics.
Security and debugging — through Vercel server logs.

Who we share data with

We do not sell your data. We share it only with the following data processors:

GitHub, Inc. (United States) — for authentication and storage of your note content. See the GitHub Privacy Statement.
Vercel, Inc. (United States) — hosting and performance analytics. See the Vercel Privacy Policy.
PostHog, Inc. — product analytics. See the PostHog Privacy Policy.
Cloudflare, Inc. (United States) — DNS and email forwarding to app@tetrad.me. See the Cloudflare Privacy Policy.

Where data is stored

Your note content— in GitHub's infrastructure (primarily in the United States, depending on your repository's region).
Analytics data — on PostHog and Vercel servers (United States / European Union).
Local data — in your browser, on your device.

When you use Tetrad from the European Union, the United Kingdom, or other regions with cross-border data transfer laws, transfers to the United States take place under Standard Contractual Clauses (SCCs) used by our processors.

How long we keep data

Session cookie: until you sign out or the cookie expires (eight hours).
Local browser data: until you clear your browser data or revoke access.
Analytics: according to PostHog and Vercel retention policies (typically one to two years).
Note content: stored in GitHub indefinitely, until you delete it.

Your rights

Regardless of your country, you have the following rights:

Access — you can request what data we have about you.
Account deletion— you can delete your account at any time from Tetrad's settings. Doing so revokes GitHub App access. Your notes remain in your GitHub repositories under your control.
Data export — your notes already live in your GitHub repository in open Markdown format, so you can download them at any time through GitHub.
Withdrawing consent for analytics — you can disable PostHog and Vercel Analytics through your browser (ad-blockers) or by contacting us at app@tetrad.me.
Filing a complaint with the supervisory authority in your country. In the European Union this is your national data protection authority.

To exercise any of these rights, write to us at app@tetrad.me. We respond within 30 days.

Cookies and tracking

Tetrad uses only cookies that are necessary for the operation of the service — authentication and interface preferences. PostHog and Vercel Analytics rely on pixels and events rather than cookies, and you can disable them through your browser settings or an ad-blocker.

Security

The session is protected by an encrypted HttpOnly cookie that is not accessible to JavaScript.
Connections to the service are protected by TLS (HTTPS).
Webhooks from GitHub are verified using an HMAC-SHA256 signature.
We do not store passwords — authentication is delegated to GitHub.

However, no service can guarantee 100% security. We recommend using a strong password on GitHub and enabling two-factor authentication.

Children

Tetrad is intended for users 13 years of age and older. For residents of the European Union, the minimum age is 16, or the user must use the service with the consent of a parent or legal guardian. We do not knowingly collect data from children below the applicable age.

Changes to this policy

We may update this Policy from time to time. For material changes, we will notify users through the service interface or by email. The last-updated date is shown at the top of this document.

Contact

All questions and requests: app@tetrad.me.