PRIVACY
The short version: raw transcripts never leave your machine, nothing is sent without your yes, and you can download or delete everything from your settings.
AgentGPA, and how to reach us
AgentGPA grades how you work with coding agents and ranks you, for fun, on public boards. This policy covers agentgpa.dev, its API and the agentgpa CLI.
The data controller is Şafak Güngör, who runs AgentGPA as a sole proprietor in Türkiye. Write to hello@agentgpa.dev with any question or request about your data.
Only what you agree to
You start on agentgpa.dev/start. It shows what the CLI reads and what it sends, asks for your choices about research and the deep read and for your yes, and records that yes with the version of this notice and the terms and the time. The command it gives you carries a one-time code: the CLI reads your agent sessions on your machine, sends what you agreed to and shows no results, since your report is on the site. Without a code it reads nothing, and with --offline, --dry-run, --json or --show-packet it makes no network call at all. A run sends:
- Counts and rates: sessions, prompts, tokens, tool calls, active days and the hours you work
- A text-free event log: when you prompted, how long, which model, which kind of tool call
- Secrets as a count by type, never a value, a part of one or its hash
- Up to 5 short quote candidates from your own prompts, redacted on your machine. They stay private until you pick them on your report page, and the ones you do not pick are deleted when you save your picks, or 30 days after the run
- Short hashes of message ids, so the same sessions cannot rank under two accounts
- A random install id, your system, your time zone and the CLI version
Never sent: your code, your files, file names, paths, project names, your agent's replies or tool output. Run the CLI with --dry-run to see every field it would send. Its code goes public at launch.
An opt-in, read once
Off unless you turn it on at /start. The CLI then sends, in the same run, a sample of up to 600 prompts you typed, each redacted and cut to 280 characters, the names of your project folders and text-free work signals. A folder name is the folder's own name only, never its path, a file name or a git address: a session run from your home folder says "home folder", and a folder whose name holds a secret, a contact, your account name or a swear says "private folder". Our model reads them once, in memory, and we drop them. We keep only the insights and habit labels it writes, and for your top three projects their folder names, their counts and two lines on what you built and how you worked there, never the prompts.
Deep read results never change your grades or ranks, and your projects never reach your deck, your cards, the boards or research. Folder names can name an employer's or a client's project, so leave the deep read off for sessions you may not share. You can delete the results from your report at any time.
Your GitHub basics
You sign in with GitHub. We get your GitHub id, handle, display name, avatar and the email address GitHub shares with us. Right after sign-in we read when your GitHub account was created, with your own sign-in token, and then drop the token.
What you add in your settings is yours to change: an alias, a bio, links, your country, a campus and your yearbook. Your country is suggested from the country your connection comes from. We do not keep your IP address; our hosting provider sees it to deliver the site and to stop attacks.
One email, then a hash
To join a campus board you verify a school email. We send one link to it and then drop the address. We keep only a keyed hash of it, so one email fits one account.
Your place on the boards, and what you pick
Your report is private until you share it. Your entrance exam, the first eligible run of each academic year, goes on the public boards, as you agree on /start before every run. There others see your grades and rank, your badges and Known for line, and your profile: your handle or alias, your avatar and GitHub link, and the bio and links you add. Never your prompts, your report, quotes you did not pick or your deep read. Your profile is public from sign-up, with only what GitHub already shows until you rank or add more. In your settings you can leave the boards, hide your profile or close your yearbook at any time, and your entrance exam stays the same either way.
Quote candidates stay private until you pick them, and bios, aliases, signatures and picked quotes pass moderation before anyone else sees them.
With the shipping check on, we search your public GitHub commits in the graded period for a coding agent's co-author line, and keep only whether the check passed.
Purposes and legal bases
- To grade your run, show your report and run your account: the service you asked for
- To show your entrance exam and your profile on the public boards: part of that service, which you agree to on /start before every run and can leave in your settings
- To keep the boards fair (message id hashes, account age, the entrance exam checks) and to stop abuse: our legitimate interest in honest boards and a safe service
- For research: anonymous counts from many developers, published only in groups of 50 people or more. On unless you turn it off, on /start before a run or in your settings
- To show what you agreed to: your choices and the version of this notice and the terms you agreed to on /start, with the time, kept with the run they started
- To send the emails you chose: campus links, unlock news and yearbook digests
- To count page views and feature use, so we know what works: daily totals in our own database, with no cookies, ids or profiles
- To tune the findings: in the beta you can rate each finding in your deck from 1 to 5, and we read the ratings only as medians across everyone
The legal review confirms each legal basis under KVKK and GDPR before launch.
The services we use
- Vercel: hosting, with our functions in Frankfurt, and BotID, which checks that a form is sent by a person
- Supabase: our database, in Frankfurt
- Anthropic, in the US: writes the teacher's note, moderates text and runs the deep read. It does not train models on our API data
- Resend: sends our emails
- GitHub: sign-in, and the shipping check when you turn it on
- Google Fonts and jsDelivr: when a card shows characters our own fonts lack, such as some scripts or an emoji, the image maker fetches fonts or emoji images for just those characters
Sending text to Anthropic moves it outside the EU and Türkiye. That transfer needs safeguards such as standard contractual clauses, and the legal review puts them in place before launch.
Retention
- Quote candidates you did not pick: until you save your picks, or 30 days after the run
- Your reports, your ratings of their findings and deep read results: while your account exists
- Event logs: for your ranked run and your latest report; others go after 180 days
- Expired codes and tokens: 7 days after they expire
- Records of moderation and bans: 2 years
- For an account banned for cheating or abuse: its GitHub account number, so the ban holds after the account is deleted
Deleting your account removes your profile, reports, event logs, deep read results and signatures within 30 days, backups included. Short message id hashes stay without any link to you, so deleted sessions cannot rank again under a new account.
Download, fix, delete, object
In your settings you can download every report as JSON, change your profile, turn research off, leave the boards and delete your account. You can also ask us for a copy of your data, a correction, a deletion or a restriction, or object to a use, at hello@agentgpa.dev. We answer within 30 days.
These are your rights under GDPR and under Article 11 of KVKK. You can also complain to the Personal Data Protection Authority in Türkiye or to the data protection authority where you live in the EU.
One cookie, a few notes in your browser
We set one cookie, to keep you signed in. Your browser also keeps a few small notes for us: the invite link you arrived with until you sign up, the last 1v1 handle you picked, the notes you closed and, on /start, your link code and your choices while the tab is open. No advertising or tracking cookies, and our analytics store nothing on your device.
Security
The CLI talks to one address only, every upload is checked against a strict schema, identifiers are stored as keyed hashes, and every table is locked to its owner. Nothing logs request bodies, prompts or quotes. Found a hole? Our security contact is in /.well-known/security.txt.
Age
AgentGPA is not meant for anyone under 16, and we do not knowingly keep data about them.
Changes
We post every change here with a new date. If a change affects what we collect or why, we tell you on the site or by email first.