Privacy

Public data only: the GitHub id, login, name, avatar and follower count GitHub shows publicly, daily counts of public merged PRs, and the contribution counts GitHub shows on the account's public profile. Those counts include private work only when the account chooses to show private contributions on its profile. For those accounts we also store how many contributions are private, but never what that work was. For each month we also store how many repositories those PRs went to, and the names of the five with the most PRs, with their counts. We don't store single PRs, titles, descriptions, comments or code. Every search we run includes is:public, even where our access could see more. We never store email addresses from GitHub, except for people who sign up for the MergeMax email below.

The MergeMax email is optional. It sends the final top 10 of every board when a month closes. There are two ways to sign up. With an email address only, on the home page: we store the address, when you sent the form and which version of its wording you saw, then send one email with a confirmation link. The address gets no other email until the link is clicked. If the link expires unused, we delete the address.

With GitHub, using the Get my numbers by email button, which signs you in with GitHub: the email also shows your own month. Sign-in proves the account is yours and reads your primary verified email address. We ask GitHub for one permission, user:email, which lets us read your email addresses. It gives no access to your repositories. Then we throw the sign-in away. There's no MergeMax account and no session.

We store your GitHub id, username, email address, when you signed up, and which version of the sign-up wording you agreed to. If your address is already on the list, it gains your numbers: one address never gets two copies. To change the address, update your primary email on GitHub and sign in again.

We keep the email address only to send you the email, and the rest to show you asked for it. Every email from the list has a one-click unsubscribe link. Unsubscribing deletes your email address and everything above. Hiding your profile stops the email showing your numbers; the address keeps getting the standings until you unsubscribe. If you signed up with GitHub and hide your profile, the email keeps your GitHub id, so your numbers come back if you show your profile again. Unsubscribe to remove it. Our email provider, Resend, sends the emails, and we delete our sent-email records after 7 days.

When you look someone up, the lookup feed shows the country the request came from, taken from our host's geo header. We keep the two-letter country code and the time. We don't store IP addresses. We keep each lookup until the account that was looked up is hidden or removed. We also keep a daily count of lookups per country, which holds no personal data.

We count page views and a few clicks (lookups, shares, email sign-ups, links to the sponsor page and its email buttons) with PostHog, an analytics service. It sets no cookies and stores nothing in your browser. To count unique visitors, PostHog makes a one-way hash of each request on its server, with a secret that changes every day, so visits on the same day can be grouped but not linked across days. The events hold no email address. A lookup event holds the GitHub username that was looked up, which is public.

We count impressions and clicks on sponsor cards. The counts hold no personal data.

Signing in with GitHub, to hide an account or for the email, sets one cookie that lasts at most 10 minutes. It checks that the sign-in you finish is the one you started, and holds the page to send you back to.

You can hide your own account by signing in with GitHub. Sign-in only proves you own the account: we ask GitHub for no permissions, read your GitHub id and username once, and throw the sign-in away. For a hidden account we keep only the GitHub id and the username, so it stays hidden after a rename. We delete everything else we store about it: its profile, its daily and monthly counts, its board places and its lookups in the feed. The email section above says what happens to an email sign-up. The account stays off every board and out of the feed. The same sign-in shows it again. Can't sign in? Email hello@mergemax.dev.