PRIVACY
The short version: raw transcripts never leave your machine, nothing is sent without your yes, and you can download or delete everything from your settings.
AgentGPA, and how to reach us
AgentGPA grades how you work with coding agents and ranks you, for fun, on public boards. This policy covers agentgpa.dev, its API and the agentgpa CLI.
The data controller is named here once the legal review is done. Until then, write to hello@agentgpa.dev with any question or request about your data.
Only what you approve
The CLI reads your agent sessions on your machine and shows you your report card first. Nothing leaves until you say yes on the consent screen, and with --offline it makes no network call at all. With your yes it sends:
- Counts and rates: sessions, prompts, tokens, tool calls, active days and the hours you work
- A text-free event log: when you prompted, how long, which model, which kind of tool call
- Secrets as a count by type, never a value, a part of one or its hash
- Up to 5 short quotes from your own prompts, redacted, each one yours to drop
- Short hashes of message ids, so the same sessions cannot rank under two accounts
- A random install id, your system, your time zone and the CLI version
Never sent: your code, your files, file names, paths, project names, your agent's replies or tool output. The CLI is open source, and its docs list every field it can send.
If you said yes to usage counts once, the CLI also sends how many times a run started, showed its report card and got your yes to upload, under a random id for that run. It never asks, and sends nothing, in agent mode, with --yes or offline.
An opt-in, read once
Off unless you turn it on. The CLI sends a sample of up to 600 prompts you typed, each redacted and cut to 280 characters, plus text-free work signals. Our model reads them once, in memory, and we drop them. We keep only the insights and habit labels it writes, never the prompts.
Deep read results never change your grades or ranks. You can delete them from your report at any time.
Your GitHub basics
You sign in with GitHub. We get your GitHub id, handle, display name, avatar and the email address GitHub shares with us. Right after sign-in we read when your GitHub account was created, with your own sign-in token, and then drop the token.
What you add in your settings is yours to change: an alias, a bio, links, your country, a campus and your yearbook. Your country is suggested from the country your connection comes from. We do not keep your IP address; our hosting provider sees it to deliver the site and to stop attacks.
One email, then a hash
To join a campus board you verify a school email. We send one link to it and then drop the address. We keep only a keyed hash of it, so one email fits one account.
Only what you choose
Your report is private until you share it. Your profile, your place on the boards and your yearbook are public only when you turn them on in your settings. Bios, aliases, signatures and quotes pass moderation before anyone else sees them.
With the shipping check on, we search your public GitHub commits in the graded period for a coding agent's co-author line, and keep only whether the check passed.
Purposes and legal bases
- To grade your run, show your report and run your account: the service you asked for
- To keep the boards fair (message id hashes, account age, the entrance exam checks) and to stop abuse: our legitimate interest in honest boards and a safe service
- For research: anonymous counts from many developers, published only in groups of 50 people or more. On unless you turn it off, on the consent screen or in your settings
- To send the emails you chose: campus links, unlock news and yearbook digests
- To count page views and feature use, with no cookies and no profiles, so we know what works
- To tune the findings: in the beta you can rate each finding in your deck from 1 to 5, and we read the ratings only as medians across everyone
The legal review confirms each legal basis under KVKK and GDPR before launch.
The services we use
- Vercel: hosting, with our functions in Frankfurt, and BotID, which checks that a form is sent by a person
- Supabase: our database, in Frankfurt
- Anthropic, in the US: writes the teacher's note, moderates text and runs the deep read. It does not train models on our API data
- Resend: sends our emails
- PostHog EU Cloud: anonymous product counts
- GitHub: sign-in, and the shipping check when you turn it on
- Google Fonts and jsDelivr: when a card shows characters our own fonts lack, such as some scripts or an emoji, the image maker fetches fonts or emoji images for just those characters
Sending text to Anthropic moves it outside the EU and Türkiye. That transfer needs safeguards such as standard contractual clauses, and the legal review puts them in place before launch.
Retention
- An unclaimed report: until one hour after its claim code expires
- Your reports, your ratings of their findings and deep read results: while your account exists
- Event logs: for your ranked run and your latest report; others go after 180 days
- Expired codes and tokens: 7 days after they expire
- Records of moderation and bans: 2 years
- For an account banned for cheating or abuse: its GitHub account number, so the ban holds after the account is deleted
Deleting your account removes your profile, reports, event logs, deep read results and signatures within 30 days, backups included. Short message id hashes stay without any link to you, so deleted sessions cannot rank again under a new account.
Download, fix, delete, object
In your settings you can download every report as JSON, change your profile, turn research off, leave the boards and delete your account. You can also ask us for a copy of your data, a correction, a deletion or a restriction, or object to a use, at hello@agentgpa.dev. We answer within 30 days.
These are your rights under GDPR and under Article 11 of KVKK. You can also complain to the Personal Data Protection Authority in Türkiye or to the data protection authority where you live in the EU.
One cookie, a few notes in your browser
We set one cookie, to keep you signed in. Your browser also keeps a few small notes for us: the invite link you arrived with until you sign up, the last 1v1 handle you picked, the notes you closed and, on /start, your link code while the tab is open. No advertising or tracking cookies, and our analytics store nothing on your device.
Security
The CLI talks to one address only, every upload is checked against a strict schema, identifiers are stored as keyed hashes, and every table is locked to its owner. Nothing logs request bodies, prompts or quotes. Found a hole? Our security contact is in /.well-known/security.txt.
Age
AgentGPA is not meant for anyone under 16, and we do not knowingly keep data about them.
Changes
We post every change here with a new date. If a change affects what we collect or why, we tell you on the site or by email first.