Privacy Policy

Last updated 1 November 2026

Roadmapper (roadmapper.rocketstack.co) turns GitHub issues into roadmap images. It is run by Westwood Hill (CP) Ltd, trading as Rocketstack ("we", "us"). This policy explains what we collect when you use the website, the API key registration or the Roadmapper GitHub App, and what we do with it. We are the controller of this data. If you have a question, email matt@rocketstack.co.

What we collect

When you register for an API key

• The repository owner and name you enter, and your email address.
• A one-way hash of your API key and the date you registered. Until you confirm your email address, we also hold the key itself for up to 24 hours so we can show it to you after you confirm; it is deleted when you confirm or when the confirmation link expires.

When you install the GitHub App

• The installation's ID and account name, the names of the repositories it covers and whether each is public or private, and the installation's plan.
• The webhook events GitHub sends us when installations, repositories, issues or labels change. We use them to keep roadmaps up to date and don't keep the event contents.

When you buy a plan on GitHub Marketplace

• GitHub tells us (when a plan changes, and when we check an account's plan with GitHub) the ID and name of the user or organization account, the plan, whether it's on a free trial, and when a purchase, change or cancellation takes effect. We keep these to apply the plan to the account's installations.
• GitHub takes the payment: we never see your card or payment details, and we don't keep the billing email address GitHub sends with a purchase.

When a roadmap is shown

• For the repository shown: the number, title, link and labels of open issues that carry a Roadmap label. We keep a copy so we don't fetch it from GitHub on every view. We don't read your code or any other issues; the only file we read is the .roadmapper file, if you use an API key.
• The IP address of the request, which we use to apply rate limits.
• Standard request logs (such as IP address, URL, time and browser user agent) kept by our hosting provider.

Analytics

• Our web pages use Google Analytics, which sets cookies and collects information about your visit, such as pages viewed, your browser and approximate location.
• When a roadmap image is viewed, we send Google Analytics an event with the repository shown and the viewer's IP address, so we can count views.

We don't ask for or collect any other personal data, and the GitHub App has read-only access: it never writes to your repositories.

Private repositories

Roadmapper doesn't show private repositories yet: support for them is coming on plans that include it. This section describes how we will handle their data once it's available. We will read the same issue data from them as from public ones, using the access you grant the GitHub App. We will treat it as confidential: we will use it only to show your roadmap and won't share it with anyone except the providers below. When the App's access to the repository ends, we stop showing and refreshing our copy, and we delete it when you ask (see "How long we keep it").

How we use it

• To provide the service: verify that a repository is registered or installed, fetch and render its roadmap, and apply its plan.
• To send you the email confirming your registration. We don't send marketing email.
• To protect the service from abuse with rate limits.
• To understand how the service is used and improve it.

Our legal bases are performance of our agreement with you (providing the service you signed up for) and our legitimate interests in running, securing and improving it.

Who we share it with

We don't sell your data. We share it only with the providers that run the service for us:

• GitHub, where we read repositories and issues, and which sells and bills paid plans on GitHub Marketplace.
• Vercel, which hosts the service.
• Upstash, which stores registrations, installation records, cached roadmaps and rate limit counters.
• Resend, which sends confirmation emails.
• Google, for Google Analytics.

These providers may process data outside your country, including in the United States. We may also disclose data where the law requires it.

How long we keep it

• Registrations are kept until you ask us to delete them. An unconfirmed registration expires after 24 hours.
• Installation records are deleted when you uninstall the GitHub App.
• Marketplace purchase records are kept while you have a plan and afterwards for as long as we need them for our billing and accounting records.
• Cached roadmap data is replaced as the repository's issues change. When the App's access to a repository ends, or its registration is removed, we stop showing and refreshing it. To have it deleted, email matt@rocketstack.co.
• Rate limit counters expire after about an hour.
• Logs and analytics are kept for the periods set by Vercel and Google Analytics.

Your rights

Depending on where you live, you may have the right to access, correct or delete your personal data, to object to or restrict how we use it, and to receive a copy of it. Email matt@rocketstack.co and we'll respond within a month. You can block analytics cookies in your browser settings. If you're unhappy with how we've handled your data, you can complain to your local data protection authority.

Children

Roadmapper isn't intended for children under 13, and we don't knowingly collect their data.

Changes

We'll post any changes to this policy on this page and update the date at the top.