Privacy Policy
Version 1.0 · Updated October 23, 2026
This policy covers foxgit.ai, the Fox Git desktop app, and the commercial license service. It explains what information we process, why, where data flows, and your rights. The Git hosting platforms you use, payment services, and the AI services you choose have their own privacy rules.
1. Controller and contact
Fox Git is operated by Yi Ruiwen as an individual based in mainland China, who is the controller of the personal information described in this policy. "We" in this policy means Yi Ruiwen.
For orders, licenses, devices, and support information we process, contact our privacy and support address: support@foxgit.ai. The app needs no Fox Git account, and purchasing does not require creating a login.
2. Local data and transfers you initiate
Your repositories, working tree files, commit history, and app settings stay on your device, and Fox Git does not upload repository contents to our servers. Data is transferred to third parties as you act:
- Fetch, pull, push, clone, and similar operations are handled by system Git talking directly to the Git remotes you configured.
- Usernames, passwords, tokens, or passphrases typed into the credential prompt go only to the Git process that asked; Fox Git neither stores nor logs them.
- When you use the AI assistant, the messages you send and the context you attach go to the model service you configured; its API key is stored in the system keychain. Without configuring or using it, installing the app never triggers AI requests.
- Screenshots, logs, and attachments you send to support may contain code or business information; please remove secrets, tokens, and unrelated personal information first.
So "local first" does not mean every feature is fully offline, or that no data ever reaches a third party.
3. Information we process and why
| Category | Information and source | Purpose |
|---|---|---|
| Orders and payment notifications | Purchase email, order identifiers, amount, currency, payment, renewal, and refund status, and related transaction event fields from the checkout and Waffo Pancake notifications | Reconciliation, license delivery, renewals, refunds, and disputes |
| Licenses and devices | License identifier, key verification digest, device digest, device name, platform, activation and check times | Identifying licenses, counting device allowance, preventing abuse, and support |
| Temporary delivery | Encrypted pending license keys, checkout requests, and claim receipt verification data | Delivering licenses securely on the result page |
| Version checks | Platform, architecture, and current version | Determining whether a new version is available |
| Network and security | IP address, request time, path, status, and necessary error details; infrastructure may record browser or client information | Serving the website and API, rate limiting, troubleshooting, and security auditing |
| Support conversations | The contact email, problem description, order number, and attachments you provide | Answering questions and handling refunds, security, and privacy requests |
We do not store full card numbers or security codes as Fox Git license data, and we never ask for them through support. Card details are handled by the Waffo Pancake checkout and related payment institutions.
4. Legal bases
Providing and maintaining your purchased license, verifying payments, and handling support are necessary to perform our agreement with you; statutory bookkeeping, tax, and regulatory requirements are handled under the corresponding legal obligations. Protecting systems and preventing abuse rely on necessary legitimate interests where applicable law allows. Optional features or other processing that legally requires consent rely on your choice or consent; you can stop using the feature or contact us to withdraw consent, without affecting earlier lawful processing.
5. Recipients and cross-border processing
Waffo Pancake handles the checkout and payment processing and sends us the notifications needed for delivery, reconciliation, and support. You can review its privacy notice when paying. Infrastructure providers for the website, license API, and support may also process necessary information to deliver the service.
The Git hosting platforms you connect to and the AI model services you configure receive data according to your actions and process it under their own rules. Make sure these services fit your code and data requirements before using them.
We do not sell personal information or share purchase or license information for cross-site targeted advertising. We may disclose necessary information to respond to lawful requests from authorities, resolve disputes, or with your separate consent.
Third-party platforms and payment services may process data outside your region, depending on the service and its infrastructure. Where cross-border processing is legally restricted, applicable notice, consent, and other safeguards apply; contact support to learn which recipients relate to your order or license.
6. Browser storage and website features
The website uses necessary browser storage. For example, the payment result page keeps the claim receipt in session storage so it can keep checking after a refresh, and interface preferences may be stored locally. Do not leave the claim page open on shared devices; close the session and clear site data when done.
The website code currently includes no advertising trackers or third-party analytics scripts. The payment checkout is a third-party page whose cookies and risk controls are described by the checkout. Browsers can limit or clear storage, which may affect result-page checks or preferences.
7. Retention and deletion
- Claim receipts and encrypted keys: claim receipts are valid for 24 hours from checkout creation, and the server periodically removes encrypted pending keys older than that. Digests and order information needed for license checks are not removed with them. The window only limits claiming on the result page and does not require activation within 24 hours.
- Orders, payment events, and license records: kept to serve you during the license period, and afterwards as needed for finance, support, fraud prevention, and disputes. You can request deletion, and we will explain what must be retained by law and why.
- Support records and operational logs: kept as needed to resolve issues, troubleshoot security, and meet legal retention, depending on case progress, log rotation, and applicable obligations.
- Local data: managed by you on your device; uninstalling does not necessarily remove all settings or keychain entries.
We review whether retention is still necessary for each purpose. Information that cannot be deleted immediately by law is restricted in use, then deleted or de-identified when the obligation ends.
8. Security
Public endpoints use HTTPS, and license checks use keyed digests and signatures. To support first delivery, the full license key is briefly stored encrypted, separately from the long-term verification digest. Keep your key and claim receipt safe and never share result-page links.
We reduce risk through access control, log redaction, and similar measures, but no networked system is perfectly secure. If a security incident affects your personal information, we will take remedial and notification measures under applicable law.
9. Your rights
Within applicable law, you can ask to know about, access, or obtain a copy of your personal information, correct it, delete it, restrict or object to processing, withdraw consent, and receive a portable copy, and you can complain to the relevant regulator.
Contact support@foxgit.ai with the type of request and an order number we can verify against. We will verify your identity as needed and usually reply within 30 days, explaining if the law requires longer. Never send your full key or card details. Deleting data required for delivery or licensing may mean we can no longer provide that service; legal retention obligations are unaffected by deletion requests.
10. Minors and service messages
The product is aimed at developers and organizations, not children. Users without the required legal capacity should have a guardian or authorized representative handle purchases and data authorization; if you find a child submitted information without the necessary consent, contact support.
Purchase confirmations, billing, and replies to security and privacy requests are necessary service communications. If we ever send marketing that requires consent, we will ask separately and offer a way to opt out; buying a license is never treated as consent to advertising.
11. Changes to this policy
Updates are dated on this page. For significant changes to purposes, information categories, or recipients, we will explain them through a website notice or available contact channels, and ask for consent again where the law requires.
Related: Terms of Service · Refund Policy · Contact support