Privacy

An account stores the name, email, and avatar your identity provider sends, plus a handle. GitHub sign-in also stores an access token so a claim can ask GitHub whether you administer a repository. That token is not shown in the dashboard.

Favorites, reviews, collections, and API keys are tied to the account. API keys are stored as a hash. Page views and install-copy counts are daily totals per server, not a profile of who clicked. Search queries are stored as text plus a result count so the directory can see which terms miss.

The newsletter stores the address you submit, whether you asked for a daily or weekly note, the time you agreed, and the IP address of that request. A confirmation link has to be used before any issue is sent. Each issue includes a one-click unsubscribe link and a preference page. Optional email (Resend), error reporting (Sentry), and analytics (Plausible) stay off until their keys are set. The demo accounts exist only when AUTH_DEMO is enabled outside production.