PRIVACY

Privacy Policy

Last updated: 10 October 2026

This policy explains which personal data is processed when you visit this website and when you use GitLama, a desktop Git client for macOS, Linux and Windows.

1. Controller

Michael Lamers
Devmil Solutions
Fliederstr. 8
83374 Traunwalchen
Germany

Email: info [at] devmil [dot] de

2. Overview

This website and GitLama are built to collect as little as possible. Devmil Solutions does not run analytics, advertising or tracking. The website sets no cookies and loads nothing from third-party servers: its scripts, styles, fonts and images come from this site. GitLama does not send your repositories, credentials or usage data to Devmil Solutions.

3. Hosting

The website is hosted by GitHub Pages (GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA). When you visit the site, GitHub processes technical access data to deliver it and keep it secure: IP address, date and time, requested page, referrer, browser and operating system. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure and reliable website).

GitHub may process data in the USA. GitHub, Inc. is certified under the EU-U.S. Data Privacy Framework (adequacy decision, Art. 45 GDPR). Details: GitHub privacy statement. Devmil Solutions has no access to these logs.

4. Downloads and release data

The download links and release notes on this site come from a static, signed release index that is served from this website. The installation packages themselves are downloaded from GitHub Releases (github.com), which may forward the download to GitHub’s file hosts such as objects.githubusercontent.com. GitHub processes the same technical access data as described under Hosting, under the same legal basis and with the same GitHub privacy statement.

5. Local storage in your browser

The website stores one value in your browser’s local storage: the language you choose (preferred-language, en or de). It is shared with the other Devmil Solutions pages on devmil.de so they open in the same language. The value stays on your device, is never transmitted, and you can delete it in your browser at any time. Legal basis: § 25(2) no. 2 TDDDG (strictly necessary for a service you requested).

6. The app

GitLama works with the repositories and hosting accounts that you choose. Repository content and credentials are not sent to Devmil Solutions. GitLama contains no analytics, no crash reporting and no telemetry. Release builds write no log file; diagnostic messages are stripped of URLs, email addresses, paths and secrets, and credentials never appear in them.

Git remotes

GitLama uses the Git installed on your computer. Clone, fetch, pull and push, as well as Git LFS and submodules, connect to the servers configured as remotes in your repositories, with your own Git configuration, credential helpers and SSH setup. By default, open repositories fetch from their remotes every 10 minutes; a fetch that needs a sign-in is skipped. You can turn this off under “Fetch automatically” in the settings. When a clone meets an SSH host it does not know yet, GitLama asks that host for its key so you can check and trust it. The operators of these servers process your data under their own privacy policies.

Hosting providers

You can connect GitHub (including GitHub Enterprise Server), GitLab (gitlab.com or a self-managed instance), Forgejo or Codeberg. GitLama then contacts that provider’s API directly from your computer to read pull or merge requests, issues, check status and review threads. With “Background refresh” enabled, it also looks up pull requests for the branches you browse. Reviews, comments and check retries are sent only after you confirm a preview. Devmil Solutions runs no server in between. The provider you chose processes these requests under its own policy, for example the GitHub privacy statement, the GitLab privacy statement or the Codeberg privacy policy; for a self-hosted server, its operator is responsible.

Sign-in

For GitHub, GitLama uses the device sign-in: you confirm a code on GitHub in your browser. For GitLab, Forgejo and Codeberg, you sign in in your browser (OAuth with PKCE), and the provider returns to an address on your own computer (127.0.0.1) on which only GitLama listens. You register the OAuth application with the provider yourself; GitLama contains no Devmil client ID or secret. Alternatively, GitLama can use the sign-in of the GitHub CLI (gh) or GitLab CLI (glab); it then reads that token when needed and does not copy it.

Credentials

Tokens for hosting connections are stored in the credential store of your operating system: the macOS Keychain, the Windows Credential Manager or the Secret Service on Linux (for example GNOME Keyring or KWallet). A Git password or token that you type into GitLama is handed to Git for that one operation through a temporary file that only your user can read; it is overwritten and deleted afterwards and not saved. GitLama uses your OpenSSH setup and SSH agent and stores no private keys. Host keys that you trust in GitLama are kept in its own known_hosts file in the profile folder.

Update checks

On macOS, GitLama uses Sparkle. Once you agree, it checks the update feed https://devmil.de/gitlama/appcast.xml on this website about once a day; you can also check manually. No system profile is sent. Updates are downloaded from GitHub Releases and verified with an Ed25519 signature before installation. On Windows and Linux, GitLama checks only when you choose “Check for updates” in the settings. It then reads https://devmil.de/gitlama/_data/releases.json from this website and can open the release notes in your browser; nothing is downloaded or installed. These requests reach GitHub Pages and GitHub Releases, which process the technical access data described under Hosting and Downloads.

Author images (Gravatar)

Author images are off by default. If you turn on “Use Gravatar”, GitLama requests images from gravatar.com (Automattic Inc.). For each commit author, it sends a SHA-256 hash of the author’s email address, not the address itself. Images are kept in memory only. See the Automattic privacy policy.

Remote workspaces

If you open a repository on another computer, GitLama connects with your system’s ssh to a host from your SSH configuration. It never asks for a password and never accepts unknown host keys. After you confirm, it copies a small helper program to that host. While tabs of a host are open, GitLama reconnects to it on its own, also when it starts. Repository data travels only between your computer and that host.

External tools

Editors, terminals, diff and merge tools, diff renderers and custom commands run on your computer as you configured them. GitLama adds no network access to them. A tool you choose may connect to the network on its own; its own policy applies.

Data on your device

GitLama keeps its settings and state in a profile folder: ~/Library/Application Support/GitLama/ on macOS, %APPDATA%\GitLama\ on Windows and ~/.config/gitlama/ on Linux. It contains your settings, recent repository paths, commit message and review drafts, tool definitions, hosting connections without their tokens, and caches. Named snapshots and the state of a running rebase are stored inside each repository’s .git folder. Deleting these folders and the credential store entries removes everything GitLama has stored.

Permissions

GitLama requests no special permissions such as camera, microphone, contacts, screen recording or notifications. It runs with your user’s file access. macOS may ask you to allow access when you open a repository in a protected folder such as Documents or Desktop, or when GitLama reads a token from the Keychain.

7. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object (Art. 21). You also have the right to lodge a complaint with a supervisory authority, for example the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, www.lda.bayern.de. To exercise your rights, contact info [at] devmil [dot] de.

8. Changes

This policy is updated when the website or the app changes. The current version is always available on this page.