What we keep, and who can see it.
gitstats counts commits. To do that it needs numbers about your work, and nothing else. This page lists every kind of data the server holds, who can read it, and how to take it back.
What is stored
- who you are
- Your GitHub login, numeric id, node id, display name and avatar URL, taken from the GitHub profile you sign in with, plus the date you joined.
- your public activity
- What GitHub already publishes about you: your contribution calendar and, per repo you have committed to, weekly commits and lines added and deleted. Collected nightly with a token that belongs to this server, never yours.
- the numbers a linked computer sends
- Per repo and per week and per day: commits, lines added, lines deleted, and the same again for work that is still on an unmerged branch. A guessed main language per repo.
- hashed repo identities
- A linked computer never sends a repo's URL. It sends an HMAC-SHA256 of the normalised remote, keyed with a secret unique to your account, so the same repo from two of your machines counts once. The key is stored here, which means the server can confirm a guess about one specific URL; it cannot turn a hash back into a URL or list your repos.
- repo names, only if you ask
- Names are off until you run gitstats names on. Public repos are matched by hash to names GitHub already publishes.
- your crews and your machines
- Crew membership and invite codes; per linked computer its name, the CLI version, when it last synced and what went wrong if it did.
- read-only tokens, if you add one
- A fine-grained GitHub token is optional. It is encrypted with AES-256-GCM and decrypted only inside the nightly job.
What is never stored
- your code
- diffs
- file or folder names
- branch names
- commit messages
- repo URLs
- your GitHub OAuth access token
- anything from repos you did not commit to
Signing in asks GitHub for read:user and user:email. The repo scope is never requested, so nothing here can read or write your code on GitHub. The access token GitHub hands back at sign-in is read once to learn who you are and then dropped — it is never written to the database.
Who can see it
Only people signed in to gitstats. There is no public page: every board and every profile needs a GitHub sign-in. What a signed-in person sees is up to you, set in the matrix under settings, which has one column for people you share a crew with and one for everyone else:
- whether they can open your page at all,
- whether private repos count in the numbers they see, or only public ones,
- whether repo names are shown, public-only, or hidden — plus a per-repo switch on your own page that hides one name from everybody.
A new account starts open on the numbers and closed on the names: your page is open to everyone signed in, private repos count in both columns, crewmates see the names of public repos and everyone else sees none. Your own page always shows you everything. Hidden repo names are masked everywhere, and a repo whose name nobody may see has no page at all.
Taking it back
Both buttons are under Data on your settings page.
- export
- Downloads every row the server holds about you as JSON: profile, settings, crews, linked computers, and every weekly and daily number. Secrets (token hashes, encrypted tokens) are left out.
- delete
- Type your login to confirm and everything above leaves the live site right then: you are gone from every board, every page and every export. One copy is held back, in a table only the site owner can read, for 30 days — the undo for a delete pressed by mistake — and the nightly job drops it after that. Nothing is mined from it and nothing else keeps a copy. A crew you started passes to whoever joined first; if you were the last member it goes too. Run gitstats unlink on each computer to clear the local config as well.
Where it runs
The site runs on Vercel and the database is Neon Postgres, both in AWS US East (N. Virginia). Vercel and Neon are the only companies that hold this data, because they run the servers it sits on. GitHub is read from, never written to.
Nothing is sold. Nothing is shared with anyone else. There is no advertising, no tracking pixel, no analytics script, and no third-party embed on any page. The only cookie is the one that keeps you signed in.
The part that runs on your computer
The CLI reads your git history the way git log does, as you, and sends the numbers above. It shows you everything it found and asks before the first upload. It is open source at github.com/yaroslavhaidash/gitstats-cli — one file, about 700 lines, with the compiled output committed next to it. Read it, or watch its traffic with any proxy. The docs page lists every command, including the ones that stop it.