GitRanks

Privacy policy

Last updated

Who is responsible

GitRanks (gitranks.com) is run by Vitalii Maslianok, a sole trader in Ukraine, at 14 Prospekt Martynova, Sofiivska Borshchahivka, Bucha district, Kyiv region, 08156, Ukraine, the controller of the personal data described here. Contact for anything about your data: [email protected].

This policy covers the GitRanks website, its badges and its posts on social networks. The GitRanks WhatsApp chatbot has its own privacy policy.

Developers on GitRanks

GitRanks ranks GitHub accounts by their public activity. This section is for the people behind those accounts, whether or not they use GitRanks. It is the information GDPR Article 14 requires.

  • What we use: what a GitHub account shows publicly. That includes the username, name, avatar, bio, company, location, website, the email address and social accounts shown on the profile, organizations, followers, public repositories and their stars, contributions to public repositories (commits, pull requests, lines changed), and stars given. We also use what we work out from these: the country, the languages, scores, ranks, tiers and how they change over time.
  • Sources: GitHub, through its public API and public archives of GitHub activity.
  • Purpose and basis: to publish rankings, profiles, badges and statistics about open-source work, and to post highlights about them on social networks. Basis: legitimate interests (Article 6(1)(f)). These are ours in running GitRanks, developers' in having their public work recognised, and the public's in finding it.
  • Fair rankings: we check for stars that look bought or exchanged. Where we find them, we may leave them out of an account's score and hold its rank until it is reviewed. Basis: legitimate interests, in rankings that can be trusted.
  • Automated ranking: scores, ranks and tiers are computed automatically from public data. They have no legal or similarly significant effect on you.
  • Recipients: everyone. Profiles, rankings and badges are public web pages that search engines index, and our posts on X, Bluesky and Mastodon may name an account and the social handles its profile links to. Also our service providers (see Who receives data).
  • Retention: while the account is public on GitHub. An account GitHub no longer returns is removed after a while. You can have your data removed at any time (see Removing your data).
  • Not informed directly: GitRanks describes millions of public accounts. Writing to each would mean unsolicited email and a disproportionate effort (Article 14(5)(b)), so we publish this information here instead.

Signing in

  • Sign in with GitHub: we receive your GitHub username, account id, name, email address and avatar link. The basic sign-in lets us read your profile and email address when you sign in; we don't keep the access it grants, except briefly for the maintainers page (see GitRanks Contribute).
  • Sign in with your own token: if you choose it, GitHub gives us a token that can act on your behalf. We use it only to read GitHub data for the refreshes you ask for, on your own GitHub limits. We keep the token until you remove your data. You can revoke it at any time in your GitHub settings, under Applications.
  • Refreshes: when you ask for a refresh that needs a star on our repository, we check with GitHub at that moment whether you have starred it. We record the refreshes, star checks and repository updates you ask for, so the limits shown on the site can be applied.
  • Basis: contract (Article 6(1)(b)), to provide what you ask for.

GitRanks Contribute

GitRanks Contribute suggests issues in public repositories, helps you work on them with an AI agent and opens pull requests from your GitHub account. This section covers what it adds to the above. Basis: contract (Article 6(1)(b)), to provide what you ask for, unless stated otherwise.

  • Your account and settings: your GitHub username and account id, your email address if your sign-in shared it, your Contribute settings and preferences (such as languages, topics, the kinds and size of issues, and the repositories you choose or ignore), the providers you asked to hear about, and the feedback you send us (we also receive it as a message). We use your email address only for the emails you ask for, such as the one telling you that a provider you asked to hear about is open, and each one lets you unsubscribe. To suggest issues, we also use what we know and work out from your public work, such as topics, languages and seniority (see Developers on GitRanks).
  • Your AI provider key: if you connect one, we store it encrypted and show only its last four characters. We use it to check that it works and to run the agent on your behalf, at your cost. We also keep the ids of the organization and workspace it belongs to, the agent setup we create there, and what each run cost. Removing the key in Contribute's settings deletes it from GitRanks; delete it at your provider too.
  • Agent runs: a run takes place in a sandbox at your AI provider, under your key. We send it the issue with its labels and comments (including their authors' usernames), other pull requests and claims on it, the repository's contributing guidelines and pull request template, our notes on the repository and, on a follow-up, the review comments on your pull request. The sandbox reads the repository's public code. We keep what the run returns (such as the change, its summary, test results and drafted replies), our checks of it, its history and its cost. When a run ends, we ask the provider to delete it. Your provider's own terms and privacy policy apply to what it processes under your key.
  • Your own agent: when your agent signs in with your GitHub account and you allow it, we keep the name its client gives itself, the address the sign-in returns it to, hashes of the tokens we give it (each access token lasts an hour, and a refresh token 30 days from its last use), and when it connected and was last used. Disconnecting it in Contribute's settings stops its tokens at once. If you create a personal token instead, we keep a hash of it, its last four characters, the name you give it and when it was last used; revoking it stops it at once. We keep what your agent sends us, such as the issues it claims, its changes, the build and test commands it reports, and its name and model. Your agent and the AI it uses are yours; we receive what your agent sends us. Until 11 November 2026, an agent could ask for the day's example issues without a token; to count how many of those later connected with one, we kept a keyed hash of its network address for 7 days, never the address itself.
  • GitHub access for pull requests: if you allow it, GitHub gives us a token that can act for you on public repositories, including ones you can write to (GitHub's public_repo permission). We store it encrypted and use it to fork repositories, push branches, open pull requests, and post and resolve comments on them, as you approve or as your Contribute settings allow. Forks, commits, pull requests and comments are made under your GitHub account and are public on GitHub. We record the pull requests opened through Contribute and read their status, reviews, comments and checks from GitHub. You can revoke this access at any time in your GitHub settings, under Applications.
  • AI-assisted work: pull requests Contribute opens for you say in their text that they were made with AI. We mark those, and pull requests your own agent opens for an issue it claimed through Contribute, as AI-assisted in our data, and may show or weigh them apart from the rest of your work wherever we show or score it.
  • The issues we suggest: Contribute reads public issues, their comments and labels, and public repository files from GitHub, including the usernames of the people who wrote them. We send some of this to our AI providers to sort the issues. We keep it while it is public on GitHub and Contribute needs it. Basis: legitimate interests, in suggesting issues worth working on.
  • Maintainers: the maintainers page has you sign in with GitHub to list the repositories you maintain and let you opt them out of Contribute. The token GitHub gives that sign-in is kept in your encrypted sign-in cookie and used for up to one hour, on that page only. When you opt a repository out, we keep your GitHub account id and username and when you did it, until the repository is opted back in. Basis: legitimate interests, in respecting maintainers' choices.
  • Deleting it: in Contribute's settings, choose Delete all Contribute data. It stops runs under way, deletes your key, settings, preferences, suggestions, runs and their history, drafted replies, agent connections and tokens and feedback, and revokes the GitHub access. If GitHub can't be told, revoke the access in your GitHub settings. Removing your data from GitRanks (see Removing your data) does the same. Forks, commits, pull requests and comments on GitHub stay there, as does your key at your AI provider, and so do the copies of your feedback we received as messages. We may keep records of the pull requests opened through Contribute and that they were AI-assisted. We also keep the records we need to stop abuse of Contribute: an access level we set on your account and flags about misuse, for up to 180 days after you delete (an open flag until 180 days after it is resolved), and checks we made of other GitHub accounts, for 30 days. Basis: legitimate interests, in keeping Contribute fair and safe.

Visiting the site

  • Technical data: IP address, browser and server logs, used for security, rate limits and to keep the site running. Basis: legitimate interests.
  • Analytics: Google Analytics counts visits and how pages are used, with cookies (see Cookies). Basis: legitimate interests, in knowing how the site is used.
  • Links in our posts: when you open GitRanks from a link in one of our social posts, we count the click with your IP address, browser and the page you came from. Basis: legitimate interests, in knowing which posts work.
  • Ways into Contribute: when you follow a link to GitRanks Contribute on our site, or a visit starts on one of its pages, we count it with the page, which link it was (and the profile, on a profile page), whether you were signed in, the campaign tags in the address and the site you came from, and whether you then connected a key or an agent (counted with the first site or campaign that brought you in the last 30 days). Your IP address and browser only tell one day's visitors apart, as a code that can no longer be traced back once the day is over; neither is stored. On your own profile, the profile is not kept. Basis: legitimate interests, in knowing which pages bring people to Contribute.

AI

Some of our posts are drafted with AI from public rankings and statistics. To draft them, we send those public data, including account names, to our AI providers. AI output can be wrong.

Who receives data

  • The public, for profiles, rankings, badges and posts, as described above.
  • Service providers that process data for us. These currently include Cloudflare (network, security, email routing), Hetzner (hosting), Google (analytics, and sending our emails), Telegram (notifications to us) and our AI providers.
  • GitHub, when we read public data and check stars, and when Contribute acts for you.
  • The AI provider whose key you connect to Contribute (currently Anthropic), under your own account with it.
  • Our professional advisers, and authorities where the law requires.
  • Someone who takes over GitRanks, if the business is transferred.

International transfers

Our servers are in the EU (Finland), and GitRanks is run from Ukraine. Some providers are in the United States. For them we rely on the EU-US Data Privacy Framework (and its UK extension) where the provider is certified, and otherwise on standard contractual clauses. Write to [email protected] for a copy. Contribute sends data to the AI provider you connect, which may be outside the EU, at your request and under your own agreement with it.

How long we keep it

  • Developer data: as described under Developers on GitRanks.
  • Sign-in data, tokens and refresh records: until you remove your data. Sign-in sessions last until they expire or you sign out.
  • Contribute data: what you give or create there, until you delete it or remove your data; other Contribute data as described under GitRanks Contribute.
  • Logs and security data: deleted automatically after a fixed rotation period.
  • Analytics: as set in our Google Analytics settings. Clicks on links in our posts: until the statistics about those posts no longer need them. Ways into Contribute: six months.
  • Backups: deleted automatically at the end of a fixed rotation. Removed data leaves the backups when the last backup holding it is deleted.
  • Removal records: a one-way hash, for as long as GitRanks runs (see below).
  • Data the law makes us keep, for the period it sets; data needed for a legal claim, until it is settled or time-barred.

Removing your data

You can have GitRanks remove its data about your GitHub account in either of two ways:

  • Signed in: open your profile, go to the Privacy tab and choose Remove my data. Only the signed-in owner of the account can do this.
  • By email: write to [email protected] from the email address your GitHub profile shows publicly, and include your GitHub username. We remove the data once we've confirmed the request comes from that address. If your GitHub email is hidden, sign in and use the Privacy tab instead.

A removal deletes your profile, your ranks and their history, the repositories you own, and your place in rankings, contributor tables and our posts on GitRanks. It also deletes your sign-in, your token, your refresh records and your Contribute data (see GitRanks Contribute). Your badges stop working. A removal can't be undone, and GitRanks won't list your account again, even if you sign in. To be listed again, write to us.

We keep only:

  • a one-way hash of your GitHub account id and username, so nothing adds your account back;
  • records against fake stars on other accounts that name your account, for as long as fair rankings need them;
  • records of pull requests opened through Contribute and whether they were AI-assisted, and any repository opt-out you made as a maintainer, until it is lifted;
  • records for stopping abuse of Contribute, for the periods given under GitRanks Contribute;
  • backups, until they are rotated out.

Posts we already published on social networks stay there. Ask us and we'll delete ours, where the network allows it. A removal covers GitRanks only.

Your rights

Under the GDPR, the UK GDPR and Ukrainian law, you can ask for access to your data and a copy of it, and for its correction, deletion, restriction or portability.

Right to object. Where we rely on legitimate interests, you can object at any time on grounds relating to your situation. To object to being ranked, have your data removed as described above.

For anything else, write to [email protected]. We reply within the time the law requires and may ask you to confirm that the account is yours. You can also complain to a data protection authority: in the EU, where you live or work or where the alleged infringement took place; in the UK, the ICO; in Ukraine, the Ukrainian Parliament Commissioner for Human Rights.

Cookies

  • Needed for the site: the sign-in session, a cookie that tells the page you're signed in, short-lived security cookies during sign-in, and Cloudflare's security cookies.
  • Analytics: Google Analytics cookies, which tell repeat visits apart.
  • In your browser only: your theme, which post links have already been counted in this tab and, for Contribute, a few details for the open tab, such as a step to finish after you grant GitHub access, how the tab's visit began, and the last link to Contribute you followed and the first site or campaign that brought you (for 30 days, to count a connect).

Age

Signing in to GitRanks is only for people aged 16 and over.

Changes

We may update this policy by posting a new version here with a new date. Where the law requires, we'll tell you.