Privacy
What is stored, and what is not
Last updated October 20, 2026
Who we are
The data controller is Pietro Romeo, sole trader, Italy, VAT IT03173170808. Write to privacy@githubworth.com about anything on this page.
Public profile snapshots
When someone looks up a username, the site reads the public profile from GitHub's API and stores a snapshot: the username, the avatar link, the number of public repos, how many of them were counted, a count of source tokens across public, original repos, the number of private contributions the profile shows (if it shows them), and when the count was made. For each counted repo it also stores the repo's name, main language, stars, last push and token count. The figures on the page are worked out from the token counts each time.
The snapshot refreshes about once an hour when the page is visited. It is the page at /u/username. Pages that count at least 100,000 tokens of code appear in the sitemap, so search engines can find them. This applies to anyone whose username is looked up, including people who have never visited the site.
We use this data under our legitimate interest in showing what public code is worth. The data is already public on GitHub, and you can object at any time by removing your page.
Removing your page
Use the removal page. The stats, the repo list, the share card and the badge are deleted, the page answers 410, and the username is kept only so it isn't computed again. To have a removed page brought back, email us from the address on your GitHub profile. If you'd rather email, write to privacy@githubworth.com. Search engines may show a removed page for a while until they recrawl it.
Private repos stay in your browser
If you connect GitHub, GitLab or Bitbucket on the private repos page, the sign-in runs through connect.dataconto.com, which passes the access to your browser. Your browser keeps it in this tab's session storage, uses it to read repo names, sizes and languages straight from the host, and drops it when you close the tab. It isn't sent to this site.
A token you paste on the private repos page is held in the page's memory and discarded when you close the tab. It isn't written to storage or sent to this site. The calls go from your browser to GitHub. The repo names, sizes and values the page shows aren't sent to this site either.
What the site logs
Anonymous events: which mode was used, how many repos were counted, values rounded to the nearest $10, which buyer button was clicked, which host you connected and whether the sign-in went through, and a timestamp. Usernames, repo names, owner names and tokens aren't logged.
To slow down abuse, the site keeps a short list of recent lookups per IP address in memory for about ten minutes. It isn't written to the database.
Site analytics
If you allow it in the banner, we use Google Analytics to count visits. It records the pages you view, the site that sent you, any UTM tags in the address, your browser and device type, and your approximate location. It sets cookies so it can tell a return visit from a new one. Google doesn't store your IP address, and we've turned off Google signals and ad personalization. Google keeps this data for 2 months. If you decline, Google Analytics doesn't load. It's off on the private repos page and the page that finishes a code host sign-in, so it never runs where your access to GitHub, GitLab or Bitbucket is held.
We use Google Analytics only with your consent. You can withdraw it under "Cookie settings" at the bottom of any page.
Who sees it
Profile pages are public. Cloudflare hosts the site and the database and keeps its own short-lived request logs, under its privacy policy. Cloudflare's network can process requests in the United States and other countries outside the EU, under the EU standard contractual clauses and the EU-U.S. Data Privacy Framework. If you allow Google Analytics, Google processes that data for us under its privacy policy and relies on the same safeguards.
When you click a buyer button, you go to the buyer's site through a link that tells it you came from here. From then on, the buyer's privacy policy applies. We don't sell personal data.
We may disclose information if a law, court order or government request requires it.
How long we keep it
A snapshot stays until the page is removed. Anonymous events stay as long as the site runs. Emails to us are kept for 24 months after our last contact.
Cookies
The site sets cookies only if you allow Google Analytics. Its cookies start with _ga and last up to 2 years. Your choice in the banner is saved in your browser's local storage, not in a cookie, so we don't ask again. To change it, use "Cookie settings" at the bottom of any page. If you switch Google Analytics off, we delete its cookies.
Cloudflare may set a security cookie to tell people from bots.
Your rights
Under the GDPR and the UK GDPR you can get a copy of the data we hold about you, have it corrected or deleted, object to how we use it, and complain to a data protection authority. Ours is Italy's Garante per la protezione dei dati personali, and you can also go to the one where you live. People in US states with privacy laws, and anywhere else, can ask for the same. Email privacy@githubworth.com and we'll reply within 30 days.
Changes
When this policy changes, the date at the top changes with it.