Privacy Policy

Supagist (supagist.app) is an open-source tool for turning code into shareable snippets and images. It is run by its maintainer, Leandro Pereira. Questions or requests about your data: supagist@leandro.io.

• Account data. If you sign in with GitHub we receive your GitHub username, avatar URL, GitHub user ID and email address. If you sign up with email we store your email address and a password hash. Your public profile holds a username (your GitHub username, or the part of your email before the @), avatar URL and GitHub user ID. Your email is not shown on your profile.
• Guest sessions. Every visitor gets an anonymous guest session automatically, so presence and reactions work without signing in. It creates a guest account and a profile named like guest_1a2b3c, with no email or avatar.
• Snippets you publish. The code, filename, an optional title, whether it is public or private, language, theme and font, line and character counts, when it was created and last viewed, and its view count. We also store images of the snippet (PNG and SVG when published from the website, SVG when published through the MCP server) and the raw code as a text file.
• Comments and reactions you add, with your account, the line and the time.
• Views. Each time a snippet page is viewed we record the snippet, the time, and the viewer's account ID (including guest accounts), to count views and keep the snippet from expiring. We do not store IP addresses or browser details with views.
• Drafts. Code and annotations you type on the home page before publishing are saved only in your browser's local storage, and are cleared when you publish.
• Rate-limit counters. To prevent abuse we keep short-lived counters keyed by your account ID. For the MCP server the counters also include your IP address. Counters whose window started more than a day ago are deleted daily.
• Logs. When a page errors we log the error message, the page path and, for server errors, the request method. Our own logs do not include request headers. Our hosting providers also keep standard request logs, which include IP addresses, for a limited time.
• Usage analytics. Vercel Web Analytics counts page views so we can see which pages are used.

When you publish a snippet you choose whether it is public or private, like a GitHub gist, and you can change it later. The website starts on public; the CLI and the MCP server publish private unless you ask for public. Public snippets can be viewed by anyone with the link, and anyone can read them (including their code) through Supagist's public API.

Private snippets are hidden, not secret. Anyone you give the link to can view one, including its code and its share image, and share the link further. Private snippets are not returned by Supagist's public API listings, are not shown in anyone else's snippet list, and their pages ask search engines not to index them. You still see your own private snippets in your list.

Comments, reactions and profiles (username, avatar and GitHub user ID) can be read by anyone through the public API, including comments and reactions on private snippets. The snippet images and raw code file are served from public URLs that are hard to guess. Never publish secrets or personal data.

While you have a snippet page or the home page open, other people viewing it can see your username and avatar (or a guest name) in the list of who is online.

AI assistants can connect to Supagist's MCP server at supagist.app/mcp after you sign in and approve access on a Supagist consent screen. The approval is recorded by our authentication provider, and the assistant receives tokens that let it use these tools as you. The MCP tools render code into SVG images, list the available options, and publish snippets. Code sent only to be rendered is not stored. Publishing saves a new private snippet (or a public one, if you ask) under your account, as described above. The tools can also edit or delete snippets you own, and never anyone else's. Before a published snippet is stored, the server replaces common secrets (such as API keys and tokens, private keys, passwords in connection strings and password or secret assignments) with visible placeholders, and Supagist does not store or log the original values. Detection covers common formats only, so check code before you publish it. We log technical details such as the language, image size and render time, not the code. MCP requests count toward the rate-limit counters described above.

Only to run Supagist: to sign you in, publish and show snippets, comments and reactions, show who is online, notify authors about new comments and reactions, count views, delete inactive snippets, prevent abuse and fix errors. We do not sell your data, we do not show ads, and we do not use your data for advertising or profiling.

We use cookies only to keep you signed in. Supabase Auth sets session cookies for your account or guest session. Your browser's local storage holds your draft, draft annotations and your light or dark theme choice. We do not use advertising or cross-site tracking cookies.

• Supabase hosts the database, authentication, file storage, realtime presence and the MCP server.
• Vercel hosts the website and runs Web Analytics and the website logs.
• GitHub handles GitHub sign-in. Avatars of GitHub users are loaded from GitHub's servers.

No one else receives your data from us.

• Snippets that have not been viewed for six months are deleted automatically, together with their images, comments, reactions and view records. There is no recovery.
• Rate-limit counters are deleted after one day.
• Drafts stay in your browser until you publish or clear your browser data.
• Accounts, profiles and guest accounts are kept until you delete them or ask us to. We do not yet delete inactive accounts automatically.

You can see your snippets at /snippets, and edit or delete them there. You can delete your account and all its data at /account. You can delete a comment you wrote from its line on the snippet. To ask what data we hold about you, email supagist@leandro.io from the address on your account. See Managing your data for what you can do yourself.

We will update this page when our practices change. The date at the top shows the latest version.