Privacy policy
This policy explains what CherryPick stores and why. Questions or requests can be sent to support@cherrypick.so.
1. Information we receive
- From GitHub: your GitHub user ID, login, avatar, granted authorization scopes, and a verified primary email when GitHub provides one. A verified email is optional; an account can continue without one.
- From you: website URLs, optional repository selections, scan results, campaign choices, approvals, and account consent records.
- From payments and operations: checkout identifiers, service events, device/network diagnostics, and security logs needed to run and protect the service.
2. How we use it
We use this information to create and secure your account, scan and match your product, prepare drafts for review, process payments, provide support, send transactional service messages, prevent abuse, and improve reliability. CherryPick currently does not submit drafts. Optional marketing messages require a separate opt-in.
3. Service providers
CherryPick uses providers needed to operate the service, which may include GitHub for authentication and authorized repository operations, Stripe for payments, Brevo for transactional email, Fastmail for support correspondence, analytics providers, and bounded website or repository research providers. We send providers only the information needed for their configured purpose.
4. GitHub authorization and retention
GitHub access tokens are encrypted at rest and are not placed in browser storage, analytics, email, or job payloads. Optional project scanning uses GitHub's classic repo scope, which can grant access to public and private repositories; CherryPick reads only the repository you select. Tokens are retained only for the configured workflow window and are revoked or deleted when no longer needed, including when you disconnect GitHub. We do not use your GitHub email for marketing unless you separately opt in.
5. Storage and choices
CherryPick stores your account and workflow records for as long as needed to provide the service, resolve disputes, meet security and accounting needs, or comply with law. The app may use local storage and cookies for your remembered website, theme, session attribution, and authentication. You can disconnect GitHub and withdraw optional marketing consent; contact us to request access, correction, or deletion where applicable.
6. Changes
We may update this policy when the service or its providers change. The effective date above identifies the current version. Material changes will be presented through the service where appropriate.