Who is responsible
GitHub.Locker is operated by Roman in the USA. For privacy questions or requests, email [email protected].
Data we collect
- GitHub account ID, login, avatar, and OAuth details needed to authenticate you.
- An encrypted GitHub access token used for the GitHub actions you request.
- A GitHub.Locker session cookie, normally lasting 30 days, and temporary OAuth state used for about 10 minutes.
- Personal tags, settings, lists, votes, moderation records, and membership interest where you provide them.
- Public repository metadata, topics, README material, and public community tags used in the catalog.
- Preferences and browser cache stored on your device, plus server logs and operational backups.
How we use it
We use this information to authenticate accounts, maintain sessions, show and synchronize public stars, perform public repository star or unstar actions requested by you, save catalog preferences and lists, operate community tags and moderation, protect the service, troubleshoot operations, and produce project briefs or summaries.
GitHub permissions
The OAuth request uses public_repo. GitHub documents this scope as read and write access to public repositories, and public repository starring requires that permission. GitHub.Locker uses the scope for the public repository catalog and the public star actions described above; it does not request GitHub's private-repository repo scope.
You can review or revoke the authorization in GitHub. Logging out of GitHub.Locker ends the local session but does not delete the account or revoke the GitHub authorization.
AI processing
Public repository README and metadata may be sent to AI processing services used to create project briefs and summaries. These inputs are public repository material.
Sharing and recipients
Data may be handled by GitHub when you authorize GitHub actions, by AI processing services for public project briefs, and by hosting, logging, and backup providers that support the service. If paid checkout is offered, Paddle may process payment and GitHub.Locker receives subscription identifiers and status. Community tags and other public contributions may be displayed to other users.
Cookies and local storage
We use a session cookie to keep you signed in and temporary OAuth state to protect the sign-in flow. Preferences and browser cache may be stored locally. You can control cookies and local storage through your browser, but some sign-in and catalog features may then stop working.
Retention, deletion, and requests
The OAuth state is designed to expire after about 10 minutes and the normal service session after 30 days. Other data is retained as needed to operate the account and service, investigate abuse or security incidents, and meet applicable legal or operational obligations. Deletion requests may be subject to the lifecycle of operational backups. GitHub.Locker does not currently offer self-service account deletion. Email [email protected] to request access, correction, or deletion where applicable law provides that right; we may need to verify the request.
Logging out is not account deletion and does not revoke GitHub authorization. Revoke that authorization through GitHub when you want to end the permission.
Security, choices, and changes
GitHub tokens are encrypted at rest and the service uses operational safeguards, but no internet service can promise absolute security. You may choose whether to authorize GitHub, whether to contribute public tags, and whether to use optional catalog features. We may update this policy when the service or its data flows change; the updated date above identifies the current version.