Privacy policy

Last updated 25 October 2026

Issues is run by Somohan. This policy explains what personal data we process when you use Issues, why, and your rights. Questions: smh@somohan.dk.

Who is responsible

Somohan is the data controller for personal data about users of Issues. Contact: smh@somohan.dk.

What we process

Account: your name, email address and, if you sign in with GitHub, your GitHub user id, username and profile picture address.

Content: what you and your organisation put into Issues – products, issues, comments, labels and their history, including who made each change. Content belongs to the organisation it was created in.

Sign-in: sign-in links and sessions (stored as hashes), and API keys (stored as hashes, with name and when they were last used).

Notifications: if you turn them on, the push address your browser gives us for that device.

Technical data: IP address and request details in short-lived server logs, used for security and to limit abuse.

Why, and on what basis

To provide Issues to you and your organisation (performance of our agreement with you, GDPR art. 6(1)(b)).

To keep the service secure and prevent abuse, e.g. rate limits on sign-in mails (our legitimate interest, art. 6(1)(f)).

We do not use your data for advertising, we do not sell it, and we do not use analytics or tracking cookies.

Cookies

Issues uses one cookie to keep you signed in, and a short-lived one during GitHub sign-in. Both are strictly necessary, so we don’t ask for consent. There are no other cookies, on the app or on this site.

Who else processes data

Resend sends our emails (sign-in links and invitations), so it receives your email address and the mail.

GitHub, if you choose to sign in with GitHub or connect repositories.

Your browser’s push service (Apple, Google or Mozilla) delivers notifications you turned on.

Some of these providers are in the USA. Transfers are covered by the EU–US Data Privacy Framework or the EU’s standard contractual clauses.

How long we keep it

Account data for as long as you have an account. Content for as long as the organisation exists – an organisation’s admins decide over its content.

Sign-in links expire after 15 minutes, invitations after 7 days, and sessions after 30 days without use. Server logs are kept for at most 30 days.

Your rights

You can delete your account yourself in the app (click your name), and admins can export everything in their organisation as JSON. You can also ask for access to your data, to have it corrected or deleted, to restrict or object to processing, and to get your data in a portable format. Write to smh@somohan.dk; we answer within a month.

You can also complain to the Danish Data Protection Agency (Datatilsynet), datatilsynet.dk.

Changes

If we change this policy in ways that matter, we will tell you in the app or by email before the change takes effect.