Privacy
Last updated July 16, 2026
What we collect
Your GitHub public profile data: avatar, bio, public repos, languages, topics, and contribution graph. When you sign in we also receive your GitHub account email, an OAuth access token kept server-side and never exposed to your browser, and a session cookie. We do not store passwords.
For public profile analytics, we keep daily total views, a referrer hostname (or the buckets Direct and DevSigil), and a two-letter country code (or Unknown). These are aggregate counters, not individual visit records.
What we do with it
We render your public sigil and generate the AI narrative from your public repos. We cache the analysis for 24 hours per profile to keep response times fast.
What we never do
We do not read private repositories. We do not sell or share your data. We do not track you across the web. We do not use cookies for advertising.
Profile analytics counters do not store the visitor IP address, analytics cookie, or user-agent. The endpoint receives the browser referrer only to immediately reduce it to a hostname bucket; it does not store the full referrer, URL paths, query strings, or fragments. We do not use a third-party analytics tracker. Our hosting platform supplies only the country code used in the aggregate.
The profile analytics endpoint processes the request IP only to derive a one-way keyed fingerprint for abuse prevention. It stores a pseudonymous fingerprint and exact timestamps of accepted requests, never the raw IP, in a separate rate-limit record. Each record is removed by an hourly cleanup between 24 and 25 hours after its last bucket update and is not used in profile metrics. Separately, other abuse-prevention rate limits may process request IP addresses and retain them for security.
Your data, your call
You can delete your account from your dashboard at any time. We remove all your stored data within 30 days. You can request a data export by emailing the address in the footer.
Profile analytics uses a rolling 30-day window. Older aggregate counters are deleted automatically every day.
Cookies
One session cookie when you sign in. Public profile analytics sends no credentials and sets no analytics cookie. No third-party trackers.