What we keep, and who can see it.

What is stored

who you are

Your GitHub login, numeric id, node id, display name and avatar URL, taken from the GitHub profile you sign in with, plus the date you joined.

your public activity

What GitHub already publishes about you: your contribution calendar and, per repo you have committed to, weekly commits and lines added and deleted, back to your first year on GitHub so ALL can add it up. Collected nightly with a token that belongs to this server, never yours.

the numbers a linked computer sends

Per repo and per week and per day: commits, lines added, lines deleted, and the same again for work that is still on an unmerged branch. A guessed main language per repo.

hashed repo identities

A linked computer never sends a repo's URL. It sends an HMAC-SHA256 of the normalised remote, keyed with a secret unique to your account, so the same repo from two of your machines counts once. The key is stored here, which means the server can confirm a guess about one specific URL; it cannot turn a hash back into a URL or list your repos.

repo names, only if you ask

Names are off until you run gitstats names on. Public repos are matched by hash to names GitHub already publishes.

your crews and your machines

Crew membership and invite codes; per linked computer its name, the CLI version, when it last synced and what went wrong if it did.

props

Who gave props to whom, and in which week. Only the member who got them sees who gave; anyone else who can open that page sees the count.

messages

What you and the person who runs gitstats write to each other in your inbox. Only the two of you can read it; it is in your export and goes when you delete your account.

visits

We count page visits without cookies and keep GitHub handles typed into the site, with where the visit came from, and, for new accounts, which page and link they came from.

read-only tokens, if you add one

A fine-grained GitHub token is optional. It is encrypted with AES-256-GCM and decrypted only inside the nightly job.

What is never stored

• your code
• diffs
• file or folder names
• branch names
• commit messages
• repo URLs (only a keyed hash of one)
• your GitHub OAuth access token
• anything from repos you did not commit to

Signing in asks GitHub for read:user and user:email. The repo scope is never requested, so nothing here can read or write your code on GitHub. The access token GitHub hands back at sign-in is read once to learn who you are and then dropped. It is never written to the database.

Who can see it

Only people signed in to gitstats. Apart from the demo board and a card you mint yourself, every board and every profile needs a GitHub sign-in. What a signed-in person sees is up to you, set in the matrix under settings, which has one column for people you share a crew with and one for everyone else:

• whether they can open your page at all,
• whether private repos count in the numbers they see, or only public ones,
• whether repo names are shown, public-only, or hidden, plus a per-repo switch on your own page that hides one name from everybody.

A new account starts open on the numbers and closed on the names: your page is open to everyone signed in, private repos count in both columns, crewmates see the names of public repos and everyone else sees none. Your own page always shows you everything. Hidden repo names are masked everywhere, and a repo whose name nobody may see has no page at all.

Anyone with the link. There is one way out of that: the SHARE button on your own page mints a card at a long, unguessable address that opens without a sign-in. It is a third column, and you write it yourself every time you press the button. You pick whether it carries the totals, the 26-week grid and the names of your top three repos, and you see the card before you send it. Because you chose to publish it, the card shows your own numbers rather than the column a stranger would get; the only thing it will not do is name a repo you hid per repo on your own page. Nothing is stored for a card: the address is the permission, signed. New link on the same panel re-signs with a fresh key, which turns every card you sent before it into a 404.

Taking it back

Both buttons are under Data on your settings page.

export

Downloads every row the server holds about you as JSON: profile, settings, crews, linked computers, and every weekly and daily number. Secrets (token hashes, encrypted tokens) are left out.

delete

Type your login to confirm and everything above leaves the live site right then: you are gone from every board, every page and every export. One copy is held back, in a table only the site owner can read, for 30 days (the undo for a delete pressed by mistake), and the nightly job drops it after that. Nothing is mined from it and nothing else keeps a copy. A crew you started passes to whoever joined first; if you were the last member it goes too. Run gitstats unlink on each computer to clear the local config as well.

Where it runs

The site runs on Vercel and the database is Neon Postgres, both in AWS US East (N. Virginia). Vercel and Neon are the only companies that hold this data, because they run the servers it sits on. GitHub is read from, never written to.

Nothing is sold. Nothing is shared with anyone else. There is no advertising, no tracking pixel and no third-party embed. The only cookie is the one that keeps you signed in. Page views are counted by Vercel Web Analytics, which is cookieless: it records anonymous page-view counts and nothing that identifies a visitor or follows one between sites.

The part that runs on your computer

The CLI reads your git history the way git log does, as you, and sends the numbers above. It shows you everything it found and asks before the first upload. It is open source at github.com/yaroslavhaidash/gitstats-cli. One file, under a thousand lines, MIT licensed, with the compiled output committed next to it. Read it, or watch its traffic with any proxy. The docs page lists every command, including the ones that stop it.

Claude Code usage, numbers only

A linked computer also counts your Claude Code usage, unless you turn it off in settings or run gitstats claude off on that computer. The CLI reads the logs Claude Code keeps on that computer and sends, per UTC day and per model: input, output, cache-read and cache-write tokens, how many replies and how many sessions, replies and output tokens per effort level, how many tool calls, how much ran in subagents, replies in each 6-hour block of your local day, how many messages you typed, the highest Claude Code version it saw, and a keyed hash that tells your computers apart. Nothing else leaves the computer: no prompts, no replies, no code, no tool names, no file or project names, no session or message ids, no timestamps, nothing finer than those four blocks of a day. Nothing is stored while counting is off, and the settings page deletes what was sent.

Who sees it follows the same rule as your page: crewmates on your crew boards, everyone signed in on the global board, and your own page as your settings allow. The private-repo switches do not apply, since there are no repos in it.

gitstats claude off stops sending. The numbers already sent are in your export; delete them on their own under Claude Code in settings, or with your account.

AI assistants (MCP)

An MCP token lets Claude Code, Codex or Cursor ask gitstats about your numbers. It reads only what you can already see on the site when signed in as yourself, through the same visibility settings, and it is read-only: nothing sent with it can change anything. The token is shown once when you create it and stored only as a sha256 hash. Each one records when it was last used, and you can revoke it any time under settings. An app you connect by signing in (claude.ai, as a custom connector) gets the same read-only access through OAuth instead: you approve it on a gitstats screen, it receives an access token that lasts an hour and a refresh token that is replaced every time it is used, and both are stored only as sha256 hashes, with the app's name, where it sent you back to, and when it was last used. Disconnect it in settings and both stop working. Your GitHub sign-in is never shared with the app. The server also counts how many MCP calls were made each day, as one number with no user attached.