RepoPress Privacy Policy

1. Scope

RepoPress is an iOS writing and publishing tool for Git-based static blogs, provided by cheng jinfang. This policy explains local storage, configured external services, optional sync, AI features, and diagnostics. Contact support@chengjinfang.com with privacy questions.

RepoPress does not require a RepoPress account and has no developer-operated default content cloud, advertising SDK, or third-party analytics SDK. RepoPress does not operate a service that forwards users’ AI or repository requests, provide shared API keys, or receive additional app telemetry. The developer does not sell personal data or collect it for advertising or tracking across apps and websites. DeepSeek, OpenRouter, and repository and deployment platforms are third-party services you choose to connect. Compatible, self-hosted, and proxy endpoints are provided by their respective operators; being configurable in RepoPress does not make them RepoPress-operated services. These services process received data under their own terms. The absence of a RepoPress server does not mean they receive or retain no data.

2. Local content and credentials

Article and note text, front matter, author fields, tags, site profiles, attachments, general materials, release history, versions, conversations, queues, and operation logs are stored locally. Preferences and some local records use UserDefaults. Processing solely on the device does not automatically upload data.

Repository, material-backup and deployment tokens and AI API keys are stored in the iOS Keychain and used within their applicable profile, host, or service scope. Relevant features send credentials to the matching authentication endpoint. Configure credentials only for services you trust and are authorized to use. Transmission in an authentication header does not establish that a complete credential is retained, or that it is never retained. Service logs, account identifiers, and retention depend on the service and account settings.

3. Repositories, publishing, and network checks

After you connect GitHub, GitLab, or a self-hosted GitLab instance, import, permission checks, sync, publishing, backups, PR/MR creation, and rollback send necessary repository/account identifiers, branches, paths, request content, and authentication to the selected host. Publishing and repository backups upload selected Markdown, front matter, and attachments such as images. Remote copies can persist in Git history, PRs/MRs, build outputs, and backups. Public repositories and websites can be accessed, copied, or cached by others.

Deployment checks may contact GitHub Pages/Actions, configured official Netlify, Vercel or Cloudflare Pages APIs, site URLs, or custom status endpoints. Those services receive necessary project/account identifiers, authentication, and network request data. An explicit article-link check sends HEAD requests to the linked hosts and may fall back to GET. It does not upload the whole article, but a link's path or query can itself contain information.

Optional background remote-change checks and local notifications are controlled by your choices and system scheduling. Checks read and count changes without automatically merging or publishing and are skipped while app or private-content locking is enabled. Notifications show change counts without article titles, text, or credentials.

4. Optional AI and system Writing Tools

When you configure AI and start a request, RepoPress sends the data needed for that operation to the configured endpoint. This can include prompts, current conversation context, article text/front matter, site name and writing preferences, related knowledge-base articles or style samples, SEO reports, publishing summaries, image metadata, or selected images. Images can be sent as actual image data, rather than only descriptions. Before the first article-context or image request for the relevant Provider, the app displays the Provider, endpoint domain, and data scope and asks for confirmation. Later requests can use an existing valid consent. You can withdraw that consent in the app.

The DeepSeek and DeepSeek Pro presets use api.deepseek.com; the OpenRouter preset uses openrouter.ai. Compatible, custom, and “local model” options use the address you enter. “Local model” is a configuration option, not a guarantee of processing on this iPhone or iPad: a LAN or remote server also receives requests. OpenAI, Anthropic, or other model companies become recipients only if you configure their services or a service such as OpenRouter routes requests to them.

RepoPress does not centrally enable AI content logging, product improvement, or training for users and has no uniform service agreement that changes the public defaults described here. The services, models, routing, and account settings users choose may still differ.

Model services may retain content, caches, security logs, account records, billing, or usage data after a request finishes. OpenRouter states that it retains per-request metadata such as token counts and latency for reporting, model ranking, and account logs. Its prompt/response logging is off by default but can be enabled by an account. Accounts can separately opt in to its use of inputs and outputs to improve its product, and downstream providers have separate retention rules. DeepSeek documents server-side disk caching of request context. Immediate deletion or zero retention cannot be inferred from that practice. Training, logs, cache lifetimes, subprocessors, processing locations, and deletion rights vary by service, model, routing, account settings, and agreement. RepoPress does not promise zero retention or a single no-training rule for every endpoint. Review the applicable terms before sending data, and avoid network AI for content that must stay on your device. Stopping use or deleting a local conversation does not delete existing provider copies.

Apple's system Writing Tools are separate from these bring-your-own-key features. Text you select is processed by the system and enabled system integrations under Apple's feature availability, settings, and applicable service rules. RepoPress does not control their processing location or retention.

5. Optional iCloud sync and backups

Note sync and iCloud snapshots require you to enable them. Note titles, tags, timestamps, archive state, source URLs, bodies, and attachments are stored in your Apple account's private CloudKit database. Deletion can leave an identifier and deletion-time marker for sync. CloudKit may send silent change notifications. The developer has no RepoPress content server or administrative interface for browsing these private notes.

Manual or automatic note snapshots and workspace backups are written to the app's iCloud container. Workspace backups contain the categories you select, such as drafts and attachments, configuration without credentials, release history, or AI conversations. They do not read or package Keychain tokens and API keys. The app cannot guarantee detection or removal of secrets you put in text, images, or conversations yourself. When device authentication protects private content, automatic workspace snapshots exclude private articles; manual exports or snapshots containing private content require authentication first.

Turning a feature off stops it from initiating new syncs or automatic snapshots. Writes or transfers already handed to iCloud may continue, and existing cloud data is not automatically erased. Automatic workspace snapshots created by this installation keep the latest seven plus one from each of up to four earlier weeks; a new copy must be verified as uploaded before eligible older copies are removed. This does not automatically remove manual, legacy, or other installations' snapshots. Manage retained copies through available app controls or iCloud storage settings. Copies on other devices, exported files, and remote backups require separate management.

6. Images, video links, and preview

RepoPress uses images you choose without automatically scanning the full photo library. Selected images are copied locally for preview, processing, repository publishing/backups, or confirmed AI image context. Before public image publishing, the app re-encodes the image and verifies privacy-metadata removal; failure to verify blocks that public publication. This does not guarantee that original files, exports, or every other transfer path have the same metadata removed.

Local Markdown preview uses bundled resources and a nonpersistent website data store. Remote images are placeholders rather than automatically fetched when ordinary preview opens. Resolving a Bilibili video link can call its public metadata API, which receives the video identifier and network request data. Generated Bilibili and YouTube embeds include player and thumbnail URLs. Generating a URL does not itself download the resource; loading it sends a resource request and network metadata to the relevant platform. Players and thumbnails on a published website are loaded by that website and its visitors' browsers under the relevant platform and website rules. Opening or explicitly checking links creates separate requests.

7. Share extension, Shortcuts, and widget

The share extension handles only the text and HTTP/HTTPS links you choose to share, including available page titles or selected text. It does not fetch the full page or read account credentials. Saving first writes a protected local App Group inbox item. Opening the main app imports it as a note, which then follows your note sync and backup settings.

Shortcuts can create notes/drafts or open the publish queue or deployment status through the app's unlock and save flows, without automatically publishing. Text you supply becomes local content. Siri, Spotlight, and Shortcuts system surfaces follow system settings.

The deployment widget reads only a local shared status enum and optional check time. It stores no article text, site name, repository URL, raw service error, or credential and has no network client. The app hides status when privacy protection is enabled. The system controls refresh and replacement of earlier rendered widget content.

8. Local diagnostics and service usage

RepoPress does not automatically upload operation logs, crash reports, or behavior analytics to the developer. Advanced local diagnostics are off by default. When enabled, filtered MetricKit crash/hang reports are saved in protected local storage excluded from backups. Fields include app/OS versions, device model, architecture, issue type, numeric exception information, hang duration, and call stacks. Reports exclude article text, notes, credentials, raw exception descriptions, signposts, and file paths.

Archive limits of 20 reports, 30 days, and 10 MiB are enforced when the app accesses the archive. You can disable diagnostics, clear the archive, or explicitly export JSON to your chosen destination. A cloud-file or sharing destination processes the exported file under its own rules. Clearing local reports does not remove exported copies. Sharing system analytics with Apple is a separate device setting.

External services may still retain request counts, token usage, response times, errors, or access logs for billing, security, auditing, service operation, and analytics purposes disclosed by the applicable service. These are separate from local diagnostics. The developer has no RepoPress analytics backend that automatically receives those service logs.

9. Purchases, permissions, and authentication

Apple StoreKit handles RepoPress Pro purchases and restoration. The app reads verified transactions and entitlement status locally. Apple processes payment; RepoPress does not obtain payment-card or bank-account details. Apple's own purchase and account processing follows Apple's policies.

You can revoke Photos and notification permissions in system settings. Face ID, Touch ID, or passcode authentication protects the app and private content. Authentication is performed by the system; the app does not receive, store, or upload biometric templates.

10. Retention, deletion, and choices

You can delete drafts and their attachments, notes, records, and profiles in the app; remove relevant tokens and AI keys; and disable AI, background checks, sync, or backups. Profile deletion handles profile-scoped credentials, conversations, queues, logs, and caches. For legacy credentials shared across profiles, removing access from one profile can disable its fallback while preserving use by another profile.

Local deletion, turning features off, or uninstalling does not recall remote publications, Git history, service logs, model caches, iCloud copies, or exported files, and does not revoke a token at its provider. Revoke credentials, remove remote records, or request deletion with the relevant service when needed. iOS manages local app data and Keychain items after uninstall; uninstalling is not a guarantee that every credential is removed. To remove access, delete credentials in the app and revoke them at the service.

11. App Store privacy information

Publishing, sync, and AI workflows can involve Other User Content, Photos or Videos, and account-level User IDs for the corresponding features. Supported OpenRouter workflows also involve retained usage and performance data, such as token counts and latency, for service operation, reporting, and model ranking. These records can be linked to a service account. Processing varies with enabled features and selected services. A token's presence in an authentication request does not automatically make it a separate Other Data Types collection. The app does not use data for developer advertising or tracking. App Store disclosures should match the submitted version and verified external-service practices; this policy does not replace that assessment with unverified zero-retention or anonymity assumptions.

All five types are declared as linked to the user and not used for tracking.

12. Children and policy changes

RepoPress is not directed to children and does not actively request personal information from children. If you believe a child's information was improperly provided through the app, contact support and the service that received it. This policy will be updated for material changes in features, data handling, or privacy disclosures.

13. Service policies and contact

Refer to GitHub, GitLab, Netlify, Vercel, Cloudflare, OpenRouter, the DeepSeek Open Platform Terms, and Apple. Ask the operator of a self-hosted or other compatible endpoint for its own policy.

Privacy and deletion questions: support@chengjinfang.com. Support materials you voluntarily provide are used only to handle the relevant request, not for marketing or model training, and retained for the necessary period. They are deleted or de-identified when no longer needed, subject to legal retention requirements. Contact support to request deletion. Do not include complete tokens, API keys, or content you do not want to disclose.