What we collect
- From GitHub when you sign in: your user id, username, display name, avatar URL, and email address (your public profile email, or your primary one if that's unset).
- From GitHub on each sync, for every public repository you own: name, description, language, links, star, fork and open-issue counts, whether it's a fork or archived, and when it was created and last pushed to.
- From you: the status, progress, due dates, renewals and epitaphs you set, a different address for notices if you add one, and whether your record is public.
- A GitHub access token with the read:user and user:email scopes, encrypted at rest, used only to read the data above.
- The IP address and browser stored with each sign-in session, for security.
What we don't
No private repositories and no code. No analytics, tracking pixels, ads, or third-party cookies.
How it's used
To show your catalog, to send one weekly notice about the projects you've checked out, and to show your public record if you turn it on. Nothing is sold or shared for marketing.
Who else sees it
- GitHub, where the data comes from.
- Resend, our email provider, which receives your address and each notice to deliver it.
- Our hosting and database providers, which store and process it to run the service.
- Anyone you share your public record with, only if you turn it on: your username, avatar, counts, project names, progress, and epitaphs.
Cookies
A session cookie that keeps you signed in, and short-lived cookies that protect the sign-in round trip. Nothing else.
Keeping and deleting
Your data stays while you have an account. Close your card in settings and your account, projects, sessions, and token are deleted at once, and the app's authorization is revoked on GitHub. Every notice has a one-click unsubscribe link.
Questions
Open an issue on GitHub. Report security problems privately, as described in the repository's SECURITY.md.
Last updated October 15, 2026.