CoCommit Legal

Effective date: 16 October 2026 · Last updated: 16 October 2026

• Privacy Policy
• Cookies and browser storage
• Terms of Service
• Copyright and intellectual property
• Contact

Privacy Policy

1. Who we are

CoCommit ("CoCommit", "we", "us", "our") is a collaboration service for software teams, available at https://cocommit.vercel.app and as a desktop app. CoCommit is operated by its founders, acting together as the data controller:

• Kotchamol Kamprasert
• Phisit Charoenkitpeeti
• Pattadon Yuttaworawit
• Trin Vejakron

(together, the "CoCommit team"). If CoCommit is later run by a registered company, that company will become the data controller and we will update this policy.

This Privacy Policy explains how we collect, use, disclose and protect personal data, in line with Thailand's Personal Data Protection Act B.E. 2562 (2019) and its subordinate regulations (the "PDPA"). It applies to everyone who uses CoCommit ("you"), wherever you live. If you are outside Thailand, section 11 explains the extra rights you may have under your local law, including the EU and UK GDPR.

We do not currently have a designated Data Protection Officer. Send privacy questions and requests to any team member listed under Contact.

2. Personal data we collect

a. Data you give us

• Account data: name, email address, password (stored only in hashed form by our sign-in provider) and profile picture.
• Content: chat messages and pins, files you upload to Drive, tasks, team context, and the questions you ask the Assistant.
• Communications: messages you send us, such as support or privacy requests.

b. Data we receive from services you connect

• GitHub: when you sign in with GitHub, we receive your GitHub username, name, email address and profile picture, and an access token with the repo and read:user permissions. The repo permission lets CoCommit read and change repositories your GitHub account can access, including private ones. We use it only to perform the actions you request in CoCommit (for example, showing commits, committing, pushing, opening pull requests, uploading files and moving tasks).
• Google: if you sign in with Google, we receive your name, email address and profile picture.

c. Data collected automatically

• Technical and log data: IP address, browser and device type, pages and features requested, dates and times, and error reports, collected by our hosting provider.
• Cookies and browser storage: see Cookies and browser storage.

d. Calls
Voice, video and screen sharing in Calls are transmitted in real time through our calling provider. We do not record calls.

e. Sensitive personal data
We do not ask for sensitive personal data (as defined in Section 26 of the PDPA, such as health, religion or criminal records). Please do not post it in CoCommit. If you do, you are choosing to disclose it to the people who can see that content.

3. Why we use personal data, and our legal basis

We do not sell personal data, use it for advertising, or use third-party analytics or tracking tools. If we ever want to use personal data for a purpose not listed here, we will tell you first and, where the PDPA requires it, ask for your consent.

If you do not provide the data needed for a feature (for example, if you do not connect GitHub), that feature will not work, but you may still use the rest of CoCommit where possible.

4. Who we share personal data with

• Other CoCommit users. Your display name, profile picture, and chat messages can be seen by other signed-in CoCommit users. Do not post passwords, API keys or other secrets in chat.
• People with access to your repository. Drive files, tasks and team context are stored in your GitHub repository (in the COCOMMIT/ folder), so anyone who can access that repository can see them. If the repository is public, that content is public.
• Service providers (data processors) who run parts of CoCommit for us and may only use data to provide their service:

• Authorities and legal requests, when the law requires it or to protect the rights, safety or property of users, the public or the CoCommit team.
• A successor, if CoCommit is transferred to a company or another operator. We will tell you before your data becomes subject to a different privacy policy.

5. International transfers

Some of the providers above store or process data outside Thailand, including in the United States. We transfer personal data abroad only as permitted by Sections 28 and 29 of the PDPA, for example where the transfer is necessary to perform our contract with you, and where available we rely on providers' contractual data-protection commitments.

6. How long we keep personal data

Deleted data may remain in our providers' backups for a limited time before it is overwritten.

7. Your rights

Under the PDPA, you have the right to:

1. Access your personal data and get a copy (Section 30);
2. Data portability: receive your data in a commonly used format or have it sent to another controller, where technically possible (Section 31);
3. Object to our use of your data, including use based on legitimate interests (Section 32);
4. Erasure: ask us to delete or anonymise your data (Section 33);
5. Restriction: ask us to pause use of your data (Section 34);
6. Rectification: ask us to correct inaccurate or incomplete data (Section 35);
7. Withdraw consent at any time, where we rely on consent. This does not affect processing that happened before you withdrew;
8. Complain to Thailand's Personal Data Protection Committee (PDPC).

To exercise a right, email any team member listed under Contact. We may need to confirm your identity first. We will respond within 30 days of receiving your request. We may refuse a request where the PDPA allows (for example, where we must keep data to comply with the law or to establish or defend legal claims), and we will explain why.

You can also remove CoCommit's access to GitHub at any time in GitHub under Settings → Applications.

8. Security

We use reasonable technical and organisational measures appropriate to the risk, including HTTPS encryption in transit, an encrypted httpOnly cookie for your GitHub access token, database access rules that block signed-out visitors from reading chat, and keeping secret keys only on our servers. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Data breaches. If a personal data breach occurs, we will notify the PDPC within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to your rights and freedoms. If the risk to you is high, we will also notify you without undue delay and tell you what you can do.

If you find a security problem, please report it to any team member listed under Contact.

9. Children and minors

• Minimum age: you must be at least 13 to use CoCommit, or older if the law where you live sets a higher minimum age for using online services.
• Parental consent:
  • Thailand: if you are under 20 (a minor under Thai law), you need your parent's or guardian's consent, unless the law allows you to consent yourself.
  • Elsewhere: if you are under the age of digital consent in your country (for example, 16 in some EU countries), you need your parent's or guardian's consent.
• We do not knowingly collect personal data from children under 13. If we learn that we have, or that we hold a minor's data without the consent the law requires, we will delete it. Parents or guardians can contact us under Contact.

10. Changes to this policy

We may update this policy. We will change the "Last updated" date, and for material changes we will notify you in the app or by email at least 14 days before they take effect, unless a change is required sooner by law.

11. International users

a. European Economic Area, Switzerland and the United Kingdom
If you are in the EEA, Switzerland or the UK, the EU General Data Protection Regulation or the UK GDPR (together, the "GDPR") may also apply. In that case:

• Controller: the CoCommit team (see section 1).
• Legal bases: the bases in section 3 correspond to the GDPR as follows: performance of contract (Article 6(1)(b)), legitimate interests (Article 6(1)(f)), legal obligation (Article 6(1)(c)), and consent (Article 6(1)(a)), which you may withdraw at any time. You can ask us for details of any legitimate-interests assessment.
• Your rights: access, rectification, erasure, restriction, data portability, objection (including an absolute right to object to direct marketing, which we do not do), and withdrawal of consent. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Requests are handled as in section 7, within one month.
• Complaints: you may complain to the data protection authority in the country where you live or work, or where an issue happened. In the UK, that is the Information Commissioner's Office (ICO).
• Transfers: your data is transferred to Thailand and to providers in the United States and other countries. Where a country has no adequacy decision, we rely on appropriate safeguards, such as a provider's certification under the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions) or the European Commission's Standard Contractual Clauses (with the UK Addendum where relevant). You can ask us for a copy of these safeguards.
• Representative: we have not yet appointed a representative in the EU or the UK. If the law requires one for our processing, we will appoint one and list it here.

b. United States

• We do not sell your personal information, and we do not "share" it for cross-context behavioural advertising, as those terms are defined in US state privacy laws such as the California Consumer Privacy Act.
• If a US state privacy law gives you rights (such as to know, access, correct, delete or opt out), you can use them through section 7. We will not discriminate against you for using your rights. If we deny your request, you may appeal by replying to our decision.
• Children: CoCommit is not directed to children under 13, and we do not knowingly collect their personal information (in line with the Children's Online Privacy Protection Act, COPPA). See section 9.

c. Other countries
If you live in another country, you may have additional rights under your local data protection law. We will honour requests made under those laws as far as they apply to us, using the process in section 7.

Cookies and browser storage

CoCommit uses only cookies and browser storage that are strictly necessary to sign you in and to run features you use. We do not use advertising, analytics or tracking cookies.

If you choose to use your own Claude API key, it is kept on your device and sent with each Assistant request to our server, which passes it to Anthropic. We do not store it on our servers.

You can delete cookies and storage in your browser settings. If you block the necessary cookies, signing in will not work.

Terms of Service

These Terms of Service ("Terms") are an agreement between you and the CoCommit team. By creating an account or using CoCommit, you agree to these Terms and to our Privacy Policy. If you do not agree, do not use CoCommit.

1. The service

CoCommit lets teams work with GitHub repositories through buttons instead of the terminal, and adds chat, file sharing, tasks, calls and an AI Assistant. Some features are new or experimental. We may add, change or remove features, and we will give reasonable notice before removing a feature you rely on, where practical.

2. Eligibility

You must be at least 13 (or older where your local law requires) and legally able to agree to these Terms. If you are a minor where you live (in Thailand, under 20), you need your parent's or guardian's consent (see Privacy Policy, section 9). If you use CoCommit on behalf of an organisation, you confirm you have authority to bind it to these Terms.

3. Your account

You must give accurate information and keep it up to date. You are responsible for keeping your login secure and for all activity under your account. Tell us promptly if you believe your account has been used without your permission.

4. Fees

CoCommit is currently free. If we introduce paid features, we will tell you the price and terms in advance, and you will not be charged unless you agree.

5. GitHub and other third-party services

CoCommit works with services run by other companies, including GitHub, Google, LiveKit and Anthropic. Your use of those services is governed by their own terms and privacy policies, and we are not responsible for them.

You are responsible for the actions you take on your repositories through CoCommit, including commits, pushes, merges, branch changes and file deletions. These actions take effect on GitHub just as if you made them yourself. Review changes before pushing to a shared branch.

6. Your content

You keep ownership of everything you submit to CoCommit, including code, messages, files and tasks ("Your Content").

You grant the CoCommit team a non-exclusive, worldwide, royalty-free licence to host, store, copy, transmit, display and process Your Content only as needed to operate, secure and improve CoCommit and to provide it to you and the people you share it with (for example, showing your messages to other users, or sending repository content to the Assistant when you ask a question). This licence ends when Your Content is deleted from CoCommit, except for copies that remain in backups for a limited time, in git history you control, or that we must keep by law.

You confirm that you have the rights needed to submit Your Content and that it does not break these Terms or the law.

7. Acceptable use

You must not:

1. break any law, or help anyone else break it;
2. upload malware or code meant to harm systems or data;
3. infringe anyone's copyright, trademark or other rights;
4. post other people's personal data without a lawful basis, or harass, threaten or abuse anyone;
5. try to access accounts, repositories or data you are not authorised to access;
6. probe, scan, overload or disrupt CoCommit or its providers, or bypass security or access controls;
7. copy, resell or reverse-engineer CoCommit, except where the law expressly allows it;
8. use CoCommit to send spam or for fraud;
9. use automated means to access CoCommit in a way that harms the service or other users.

We may remove content or restrict access that we reasonably believe breaks this section.

8. AI Assistant

The Assistant uses an AI model (Claude, by Anthropic). AI output can be inaccurate, incomplete or out of date. You are responsible for reviewing output before you rely on it, especially code and git instructions. Do not include secrets or sensitive personal data in questions. If you use your own Anthropic API key, Anthropic bills you directly under its own terms.

9. Desktop app

The desktop app's Local folder mode runs git on your computer, on folders you select. These changes affect your real files. Keep backups. You may use the desktop app only for your own use of CoCommit.

10. Feedback

If you send us ideas or suggestions, we may use them without any obligation to you.

11. Suspension and termination

You may stop using CoCommit at any time and ask us to delete your account (see Privacy Policy, section 7).

We may suspend or close your account, with notice where practical, if you seriously or repeatedly breach these Terms, if required by law, or if needed to protect users or the service. If we stop offering CoCommit altogether, we will give at least 30 days' notice where possible so you can export your data. Content stored in your GitHub repositories stays there.

Sections 6 (licence for retained copies), 12, 13, 14, 16 and 17 survive termination.

12. Disclaimer

To the fullest extent permitted by law, CoCommit is provided "as is" and "as available", without warranties of any kind, express or implied, including warranties of merchantability, fitness for a particular purpose, and non-infringement. We do not guarantee that CoCommit will be uninterrupted, error-free or secure, or that data will never be lost.

13. Limitation of liability

To the fullest extent permitted by law:

1. we are not liable for indirect, incidental, special or consequential loss, or for loss of profits, data, code or goodwill;
2. our total liability for all claims relating to CoCommit is limited to the greater of the amount you paid us in the 12 months before the claim, or THB 1,000.

Nothing in these Terms excludes or limits liability for our fraud, wilful misconduct or gross negligence, or any other liability that cannot be excluded or limited under applicable law, including Thailand's Civil and Commercial Code and Unfair Contract Terms Act B.E. 2540 (1997), and the mandatory consumer protection laws of the country where you live.

14. Indemnity

To the extent permitted by law, you agree to compensate the CoCommit team for reasonable losses and costs (including legal fees) arising from third-party claims caused by Your Content or your breach of these Terms.

15. Changes to these Terms

We may update these Terms. For material changes, we will notify you in the app or by email at least 14 days before they take effect. If you do not agree to the changes, stop using CoCommit before they take effect. Continuing to use CoCommit after that date means you accept the updated Terms.

16. Governing law and disputes

These Terms are governed by the laws of the Kingdom of Thailand. If a dispute arises, please contact us first. We will try to resolve it informally within 30 days. If we cannot, the dispute will be decided by the competent courts of Thailand.

Consumers outside Thailand: if you use CoCommit as a consumer and live in the EU, the UK or another country whose law gives you mandatory protections, the choice of Thai law does not take those protections away, and you may also bring a claim in the courts of the country where you live if that law allows it. EU consumers can also use the EU's online dispute resolution options where available.

17. General

• Entire agreement: these Terms and the Privacy Policy are the whole agreement between you and us about CoCommit.
• Severability: if any part of these Terms is found invalid or unenforceable, the rest stays in effect.
• No waiver: if we do not enforce a right, we have not waived it.
• Assignment: you may not transfer these Terms without our consent. We may transfer them to a company that takes over CoCommit, with notice to you.
• Events outside our control: we are not responsible for delays or failures caused by events beyond our reasonable control, including outages of third-party providers.
• Language: these Terms are written in English. If we publish a translation and there is a conflict, the English version controls to the extent permitted by law.

Copyright and intellectual property

1. Ownership

© 2026 Kotchamol Kamprasert, Phisit Charoenkitpeeti, Pattadon Yuttaworawit and Trin Vejakron (the CoCommit team). All rights reserved.

The CoCommit software, website, design, logo and name are owned by the CoCommit team and protected by the Copyright Act B.E. 2537 (1994) of Thailand, as amended, and other intellectual property laws. Except for the right to use CoCommit under these Terms, no licence is granted to you. You may not copy, modify, distribute or create derivative works from CoCommit without our written permission.

2. Your content

Your Content belongs to you (see Terms of Service, section 6).

3. Open-source software

CoCommit includes open-source software, used under its own licences. Those licences take priority over these Terms for that software:

The full licence texts are distributed with each package.

4. Trademarks

GitHub, Google, Claude, Anthropic, LiveKit, Supabase and Vercel are trademarks of their respective owners. CoCommit is not affiliated with, sponsored by or endorsed by them. The CoCommit name and logo may not be used without our permission.

5. Copyright complaints (notice and takedown)

We respect copyright and respond to notices consistent with the Copyright Act of Thailand, including the notice-and-takedown provisions added by the Copyright Act (No. 4) B.E. 2565 (2022).

If you believe content on CoCommit infringes your copyright, email any team member listed under Contact with:

1. your name, address, phone number and email;
2. a description of the copyrighted work;
3. the exact location of the infringing content on CoCommit (a link);
4. a statement that you believe in good faith the use is not authorised by the owner or the law;
5. a statement that the information in your notice is accurate and that you are the owner or authorised to act for the owner;
6. your physical or electronic signature.

When we receive a complete notice, we will promptly remove or disable access to the content and notify the user who posted it. That user may send a counter-notice if they believe the removal was a mistake. Knowingly false notices may lead to legal liability.

Content stored in a user's own GitHub repository is hosted by GitHub. You can also report it to GitHub directly.

We will close the accounts of users who repeatedly infringe copyright.

Contact

The CoCommit team:

Website: https://cocommit.vercel.app

You can also contact Thailand's Personal Data Protection Committee (PDPC) about how we handle personal data.