Privacy Policy

Effective date: August 18, 2026  ·  An IANternet Media project

1. Who We Are

RepoVelocity is a GitHub repository discovery and ranking service operated by IANternet Media ("we," "us," or "our"). This Privacy Policy explains how we collect, use, and protect information when you use repovelocity.com (the "Service").

RepoVelocity is an independent project and is not affiliated with GitHub, Inc. or Microsoft Corporation.

2. Data We Collect at a Glance

3. Information We Collect

3.1 Automatically Collected Data

When you visit RepoVelocity, our infrastructure (Cloudflare Workers and Cloudflare's global network) may automatically record:

• IP address — used for rate-limiting, abuse prevention, and geographic load-balancing
• Browser and device information — User-Agent string, referring URL
• Request details — the URL path you accessed, HTTP method, response status, and bytes transferred
• Timestamps — date and time of each request

This data is processed by Cloudflare as our infrastructure provider. We do not operate our own server-side analytics beyond what Cloudflare provides in aggregate dashboards.

3.2 GitHub Public Data

RepoVelocity indexes publicly available repository data from the GitHub GraphQL API. This includes:

• Repository names, descriptions, topics, and primary programming language
• Star counts, fork counts, and their change over time
• Commit activity counts and contributor counts (sampled from public commit history)
• Repository creation and last-push timestamps
• Repository owner usernames and public avatar URLs

All of this data is publicly visible on GitHub. The repository indexing described in this section reads public data only — it does not touch private repositories or the private account details of the people who own them.

This is separate from the account data covered in 3.3 below. If you sign in to RepoVelocity, you grant us an OAuth token, and we use it to read your own GitHub profile — including an email address that may not be public. That is a deliberate part of signing in, not part of the indexing described here.

3.3 Account Data

Browsing RepoVelocity requires no account. If you choose to create one, the only sign-in method is GitHub OAuth — there is no password to invent, and we never see or store a GitHub password.

We request the read:user and user:email scopes. Using the token GitHub returns, we read and store:

• Your GitHub user id — the permanent numeric id, which is what your account is keyed on
• Your GitHub handle, display name, and avatar URL — used to render the signed-in header
• Your email address — taken from your public profile if you have one set. If you do not, we call GitHub's /user/emails endpoint and store your primary verified address, which is frequently an address you have not made public. If we cannot resolve one, that is not an error and sign-in still succeeds; we simply store no address for you.
• Account timestamps — when the account was created and when you last signed in

We do not use the OAuth token to write to any repository, and we never request a scope that would let us. The token is used at sign-in and is not stored afterwards.

Your stored email address is visible to a RepoVelocity administrator in an internal admin panel, alongside your handle and membership status. It is not shown to other members and does not appear anywhere on the public site.

What you save

Once signed in, anything you save is stored against your account: your bookmarks, the folders you organise them into, and the repositories you ask us to track. Deleting your account deletes all of it (see Section 10).

Sessions

Signing in creates a session that lasts 30 days and is extended when you return. The session token is a random value generated on our server; only its SHA-256 hash is written to our database, so a database dump cannot be replayed as a login. Signing out deletes the session record immediately, and an hourly job purges expired sessions.

3.4 Payment Data

RepoVelocity offers a paid membership. Payment is processed entirely by Stripe.

Card numbers, CVCs, and billing addresses never touch RepoVelocity's servers. You enter them on Stripe's own checkout page. What we store against your account is the Stripe customer id, your membership status, and — so the admin panel can report on plans without calling Stripe on every page load — the price id, amount, and billing interval of your subscription, plus the date your current period ends.

3.5 Cookies and Local Storage

RepoVelocity sets three cookies. All three are set with HttpOnly, Secure, and SameSite=Lax, meaning they cannot be read by JavaScript and are not sent on cross-site requests:

• rv_session — identifies your signed-in session. Set only when you sign in; lasts 30 days.
• rv_oauth_state — a short-lived anti-forgery value used during the GitHub sign-in handshake. Expires after 10 minutes.
• rv_d1 — a database consistency marker. Our database serves reads from replicas around the world, and this ensures your next request is not served by a replica that has not yet caught up with something you just did. It contains no information about you. Lasts 7 days.

These three are functional — they exist to make sign-in and saving work, not to profile you. None of them tracks you across other websites.

We also use your browser's sessionStorage to remember that you dismissed the newsletter prompt. That value never leaves your browser.

Third-party scripts

Every page of this site loads Google Tag Manager (container GTM-NJM66N6J), which we use for analytics — page views and a small number of interaction events, such as a newsletter sign-up completing. Google Tag Manager and any tags loaded through it may set their own cookies and may collect data governed by Google's Privacy Policy, over which we have no control. If you wish to block this, a content blocker or your browser's tracking-protection setting will stop it loading; the site works normally without it.

Pages that let you add a repository to track also load Cloudflare Turnstile, an anti-bot challenge, from challenges.cloudflare.com. Logos and images are served from Cloudflare Images.

We do not run advertising, and we do not load advertising networks or cross-site ad tracking on any page.

3.6 Mailing List and Newsletter

We keep mailing lists with our email provider, InboxEngine. Your name and email address reach it in two ways:

• When you sign in. Your account email address (from 3.3) is added to our free mailing list the first time you sign in. If you go on to buy a membership, your address is also added to a separate paid-members list. This happens once per list — signing in repeatedly does not re-send it.
• The newsletter form. The rankings page shows an inline newsletter sign-up. If you submit it, the name and email you type are added to the same mailing list. This form is optional and does not require an account.

Either way, we store only that you are on a list — the addresses themselves live with InboxEngine. Every message we send includes an unsubscribe link, and unsubscribing removes you from that list.

4. How We Use Information

We use the information described above solely to:

• Operate, maintain, and improve the Service
• Authenticate you and maintain your session
• Process membership payments through Stripe
• Send you product updates and newsletters (with unsubscribe in every message)
• Detect and prevent abuse, excessive API usage, or attacks on our infrastructure
• Compute ranking scores and trend data for the repositories we index
• Debug errors and diagnose performance problems
• Sign you in and keep you signed in, and show your handle and avatar in the interface
• Store what you save — bookmarks, folders, and tracked repositories — and show it back to you
• Determine what your account can access, which is what membership status and the paid-through date are for
• Take payment and manage subscriptions through Stripe, including renewals and cancellations
• Understand how the site is used in aggregate, through the analytics described in 3.5
• Send you the newsletter, if you signed up for it
• Comply with legal obligations

We do not sell your data, and we do not use it for advertising or for building a profile of you to show to anyone else.

When you sign in, your account email address is added to our mailing list, and if you become a paid member it is added to a separate paid-members list (see 3.6). Every message we send carries an unsubscribe link, and unsubscribing removes you from that list. Your account email is never sold, and it is shared with no third party other than our mailing list provider, InboxEngine.

5. How We Share Information

5.1 Infrastructure Providers

Our Service runs on Cloudflare Workers and stores ranking data in Cloudflare D1 (a SQLite-based edge database). By using the Service, request data necessarily passes through Cloudflare's network. Cloudflare processes this data according to their own Privacy Policy.

5.2 GitHub

We make API calls to GitHub on our servers to retrieve public repository data. GitHub processes these requests according to their Privacy Statement. The repository indexing itself sends no visitor information to GitHub.

Signing in is different by necessity: the OAuth handshake sends you to GitHub, and GitHub therefore knows you authorised RepoVelocity. You can review and revoke that authorisation at any time in your GitHub account's authorised OAuth apps settings. Revoking it stops us reading your profile, but does not by itself delete data we have already stored — for that, see Section 10.

5.3 Service Providers

Beyond Cloudflare and GitHub, the following third parties process data on our behalf:

Each of these processes data under its own privacy policy: Stripe, Google. We share the minimum each one needs to do its job, and none of them is permitted to use your data for their own marketing.

5.4 No Sale of Data

We do not sell, rent, trade, or otherwise transfer any information to third parties for their commercial use.

5.5 Legal Requirements

We may disclose information if required to do so by law, court order, or governmental authority, or when we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.

6. Data Retention

6.1 Your Account

We keep your account data — profile details, email address, and everything you have saved — for as long as your account exists. There is no automatic expiry: an account you stop using is not deleted on a timer, because doing so would silently destroy saved bookmarks. It is deleted when you delete it (see Section 10).

• Sessions — expire 30 days after they are last extended. Signing out deletes the record immediately, and an hourly job purges expired ones.
• Billing records — the Stripe customer id and subscription details are kept while your account exists. Stripe retains its own transaction records independently, for periods its policies and financial regulations set.
• Newsletter — your name and email stay on the list held by InboxEngine until you unsubscribe or ask us to remove them.

6.2 Repository Data

Repository ranking snapshots are kept so the site can show growth over time. We currently retain the full history of hourly snapshots for the repositories we track; we may introduce a tiered schedule that thins older snapshots as the dataset grows, and we will update this section if we do. This data describes public repositories, not visitors.

6.3 Logs

Server access logs are retained according to Cloudflare's standard log retention policies (typically up to 7 days in free/pro tiers). We do not maintain our own long-term log archives.

Account data is retained for as long as your account exists. Sessions expire automatically after 30 days and are purged from the database hourly. If you request account deletion, we remove your user record and all associated data (bookmarks, folders, tracked repos, sessions, and mailing list records). Stripe retains its own payment records independently, per their retention policy.

7. Children's Privacy

RepoVelocity is not directed at children under the age of 13. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, please contact us and we will delete it promptly.

8. Security

We take reasonable technical measures to protect the Service, including TLS encryption for all traffic, edge-level DDoS mitigation through Cloudflare, and access controls on our database. However, no method of transmission or storage is 100% secure. We cannot guarantee absolute security of any information.

9. International Visitors

RepoVelocity is served from Cloudflare's global edge network. If you are located outside the jurisdiction where IANternet Media operates, your request data may be processed in data centres around the world as part of Cloudflare's normal operations. By using the Service, you consent to this processing.

10. Your Rights and Deleting Your Data

Depending on where you are located, you may have certain rights regarding personal data. If you have never signed in, the only data we hold about you is server log data and whatever the analytics described in 3.5 collected. If you do have an account, we hold the data described in Section 3, and the following apply to it:

• Access: You may request a copy of the personal data we hold about you
• Correction: You may request correction of inaccurate data. Note that profile fields are refreshed from GitHub each time you sign in, so correcting your name or email on GitHub and signing in again updates them here too
• Deletion: You may delete your account and its data yourself, at any time — see 10.1
• Objection: You may object to certain processing of your data

10.1 How Deletion Works

You can delete your account yourself, without asking us. Sign in, open your bookmarks, and choose Account in the sidebar. You will be asked to type your GitHub handle to confirm, and the deletion happens immediately.

When your account is deleted, we remove your user record and everything attached to it: your profile details and email address, your sessions, your bookmarks, your folders, and your tracked repositories. This is enforced by the database itself, so nothing is left orphaned behind. Deletion is permanent and we cannot restore the account afterwards.

If you have a paid membership, we cancel it with Stripe before deleting anything. If that cancellation fails for any reason, we stop and delete nothing — we would rather leave you with an account you can try again from than remove your record while a subscription is still charging you.

Some things sit outside that deletion, and we would rather name them than let you assume otherwise:

• Stripe keeps its own records of any payments you made. We can end your subscription, but financial record-keeping rules mean Stripe retains transaction history independently of us.
• The newsletter list is held by InboxEngine and is separate from your account. Deleting your account does not unsubscribe you, and unsubscribing does not delete your account. Tell us if you want both, and we will do both.
• Administrator accounts cannot be deleted from the panel, for internal safety reasons. Contact us and we will action it.
• If you cannot sign in, the panel is not reachable — deleting an account requires a signed-in session. Contact us using the details in Section 12 instead.

If you only want to end a subscription rather than delete anything, you can do that on its own at any time through the Stripe customer portal, linked from the membership page.

Requests related to GitHub repository data (star counts, descriptions, contributor figures) are outside our control — that data is sourced from and governed by GitHub's own policies. To have your GitHub data corrected or removed, contact GitHub directly.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will update the effective date at the top of this page when we do. Continued use of the Service after any changes constitutes your acceptance of the revised policy.

12. Contact

For privacy questions, data requests, or concerns:

• Email: support@repovelocity.com — use this for access, correction, and deletion requests, and for anything else covered by Section 10
• X (Twitter): @ianternet
• Company: IANternet Media

Please send data requests by email rather than social media — we need a reliable channel to reply on, and a public reply is rarely the right place for it.