Privacy and Data Handling

Understand what Workrail processes, what it does not ingest, and how privacy boundaries work.

What Workrail captures

Workrail uses a metadata-only sync model.

• Commit metadata: hash, timestamp, author, message, changed file paths
• Branch names and repository structure
• Aggregate diff statistics (files changed, lines added/removed)

Workrail processes commit metadata used for grouping and summaries, such as:

• Commit id and timestamp
• Commit message text
• Branch/ref text
• File path lists
• Aggregate numeric change counts

If you opt in to GitHub context, Workrail also reads repository-scoped PR and issue titles, descriptions, labels, dates, public links, and deterministic commit/PR/issue relationships through your locally authenticated GitHub CLI. This context is encrypted before it is stored by Workrail.

What Workrail does NOT capture

• Source code content
• File diffs or patches
• File contents at any revision
• Comments, reviews, or discussions
• Pull request diffs, review bodies, or CI/check output
• GitHub authentication tokens
• Repository configuration beyond basic structure

Your code stays on your machine. Standard sync reads Git metadata; optional GitHub context adds only the listed PR and issue metadata.

How processing works

1. CLI collects commit metadata locally
2. Metadata is sent to Workrail servers
3. AI generates summaries and hints from metadata + your existing entry context
4. Output is constrained by schema and privacy guardrails

AI generation is constrained by schema and privacy guardrails. The model output is based on allowed metadata and your existing entry context, not source code ingestion.

Data ownership and deletion

• You own your data
• You can delete entries and projects at any time
• You can export your data
• You can cancel and close your account

Security basics

• Encrypted in transit (TLS)
• Encrypted at rest
• No sharing with employers or third parties

Product analytics

Workrail uses PostHog for a small set of intentionally named product events, such as setup progress and Impact Snapshot creation, generation, and first open. Autocapture, automatic page views, session recording, and identified profiles for anonymous visitors are disabled.

Analytics events use strict property allowlists. Workrail does not send entry content, repository names, commit messages, review drafts, PR or issue text, or other work evidence as analytics properties. Landing-page campaign tags are accepted only as short, restricted values. Automatic campaign persistence and referrer capture remain disabled.

For questions: [email protected]