Privacy

Last changed 27 September 2026. This describes what the code in this repository does.

What you send

The public repository name you type (owner/name).
Your IP address, as part of every web request. It is used only to compute a keyed pseudonym (an HMAC with a server secret) for rate limits. The raw IP is never stored or logged.

Analysis results, built only from the repository's public git history: file paths, dates, change counts, line counts and co-change pairs. Contributors appear as Contributor 1, Contributor 2 and so on (the repository's own .mailmap, if it has one, is used only to count one person's name spellings once). No names, no email addresses, no file contents. Results are cached for reuse by anyone who asks for the same repository and commit. A result is deleted once it is more than 30 days old and nobody has asked for that repository at that commit in the last 7 days.
Pull request overlays: for an open pull request someone asked about, the paths of the files it changes and whether each was added, changed, deleted or renamed, from GitHub's public test merge of it. No file contents, no titles, descriptions, authors or comments. Deleted after 7 days.
Job records: repository name, commit, status, time, and the IP pseudonym above. The pseudonym is kept only while the job is queued or running (it enforces two active jobs per client); when the job finishes or fails it is overwritten with zeros. Finished job records are deleted after 7 days.
Service logs: job ids, owner/name and outcome codes. No IP addresses, no request headers or bodies. At most 30 MB per service is kept, oldest first out.

No accounts, no cookies, no analytics, no tracking, and no requests to any third party from your browser.
No private repositories: only public GitHub repositories can be analysed.
Nothing is stored in your browser except the scroll position of the story (for this tab only) and, if you change it, your graphics quality setting.

A share link carries the repository name, camera position and point in time after the #. Browsers do not send that part of a URL to the server.

Open an issue on the project's GitHub repository. The code, including these controls and their tests, is public.