Last updated: 5 October 2026
This notice explains what personal data Codebase Time Machine processes, why, on what legal basis, and for how long. It covers visitors to this website and clients of our repository analysis service (Art. 13 GDPR).
Josiah Shirt, trading as Codebase Time Machine, Bremen, Germany. Email: hello@codebasetimemachine.com. You'll reach a person, not a support queue.
The "Book a call" buttons link to Calendly (Calendly LLC, USA). If you book, Calendly processes your name, email address, the time you choose and any answers you give, and passes them to us so we can hold the call. Legal basis: steps taken at your request before a contract (Art. 6(1)(b) GDPR). For transfers to the USA, the safeguards are as described in Calendly's own privacy notice, which applies on its pages. We keep booking details for as long as the conversation is active, and delete them within 12 months of our last contact unless an engagement follows.
If you email us, we process what you send, typically your name, email address and message. Our email is hosted by IONOS SE, Germany. Legal basis: Art. 6(1)(b) GDPR where you ask about an engagement, otherwise our legitimate interest in answering you (Art. 6(1)(f)). We delete the correspondence when it is no longer needed, at the latest 12 months after our last contact, unless we must keep it for legal reasons (for example, commercial and tax retention duties).
When you engage us, we process the following to run the analysis:
Purpose and legal basis. To produce the report you have asked for (Art. 6(1)(b) GDPR towards you as our client). For the contributors whose names appear in the commit history, we act on your instructions as your processor, and we can sign a data processing agreement under Art. 28 GDPR.
Where it runs. The repository is cloned onto the machine running the analysis, into a temporary directory created for that scan. Before an engagement we tell you, in writing, which machine and which providers (if any) are involved, and list them in the data processing agreement.
AI. The optional AI narrative is off by default. With it off, no part of your repository, no commit message and no contributor identity reaches any AI service. We enable it only if you agree in writing first.
Pseudonymisation. By default, contributor names and email addresses are replaced with pseudonyms such as "Contributor A". Names that appear inside file paths, commit messages or code-owner team handles are not scrubbed. This is pseudonymisation, not anonymisation.
The providers named above: GitHub (website hosting), Calendly (call bookings) and IONOS SE, Germany (email). For an engagement, any provider that hosts the analysis is named to you in writing before it starts and listed in the data processing agreement. Billing details go to our tax adviser and our bank, as needed for accounting and payment. We do not sell, rent or share your data for marketing.
No law requires you to give us personal data. Without your name and email address we cannot book a call or answer you, and without read access to the repository we cannot run the analysis.
We make no decisions about you based solely on automated processing, including profiling (Art. 22 GDPR). The report measures commit history; any conclusion about a person is for you and the company's management to confirm.
You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). To exercise them, email hello@codebasetimemachine.com.
Right to object (Art. 21 GDPR). Where we process your data on the basis of our legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation. We then stop, unless we can show compelling legitimate grounds that override your interests, or need the data to establish, exercise or defend legal claims. Email hello@codebasetimemachine.com.
You also have the right to complain to a data protection supervisory authority. The authority responsible for us is: Die Landesbeauftragte für Datenschutz und Informationsfreiheit der Freien Hansestadt Bremen.
We hold no certification (no SOC 2, no ISO 27001, no GDPR certification) and do not encrypt repository data at rest. Our Security & Trust Pack states our controls and open gaps; ask us for it.
If this notice changes, we update the date at the top of this page.