Privacy
What is stored, and what is not
Last updated October 20, 2026
Who we are
The data controller is Pietro Romeo, sole trader, Italy, VAT IT03173170808. Write to privacy@githubworth.com about anything on this page.
Public profile snapshots
When someone looks up a username, the site reads the public profile from GitHub's API and stores a snapshot: the username, the avatar link, the number of public repos, how many of them were counted, a count of source tokens across public, original repos, and when the count was made. The figure on the page is worked out from the token count each time.
The snapshot refreshes about once an hour when the page is visited. It is the page at /u/username, and it appears in the sitemap, so search engines can find it. This applies to anyone whose username is looked up, including people who have never visited the site.
We use this data under our legitimate interest in showing what public code is worth at a buyer's rates. The data is already public on GitHub, and you can object at any time by removing your page.
Removing your page
Use the removal page. The stats and the share card are deleted, the page answers 410, and the username is kept only so it isn't computed again. To have a removed page brought back, email us from the address on your GitHub profile. If you'd rather email, write to privacy@githubworth.com. Search engines may show a removed page for a while until they recrawl it.
Private repos stay in your browser
A token you paste on the private repos page is held in the page's memory and discarded when you close the tab. It isn't written to storage or sent to this site. The calls go from your browser to GitHub. The repo names, sizes and values the page shows aren't sent to this site either.
What the site logs
Anonymous events: which mode was used, how many repos were counted, values rounded to the nearest $10, which buyer button was clicked, and a timestamp. Usernames, repo names, owner names and tokens aren't logged.
To slow down abuse, the site keeps a short list of recent lookups per IP address in memory for about ten minutes. It isn't written to the database.
Who sees it
Profile pages are public. Cloudflare hosts the site and the database and keeps its own short-lived request logs, under its privacy policy. Cloudflare's network can process requests in the United States and other countries outside the EU, under the EU standard contractual clauses and the EU-U.S. Data Privacy Framework.
When you click a buyer button, you go to the buyer's site through a link that tells it you came from here. From then on, the buyer's privacy policy applies. We don't sell personal data.
We may disclose information if a law, court order or government request requires it.
How long we keep it
A snapshot stays until the page is removed. Anonymous events stay as long as the site runs. Emails to us are kept for 24 months after our last contact.
Cookies
The site sets none. Cloudflare may set a security cookie to tell people from bots.
Your rights
Under the GDPR and the UK GDPR you can get a copy of the data we hold about you, have it corrected or deleted, object to how we use it, and complain to a data protection authority. Ours is Italy's Garante per la protezione dei dati personali, and you can also go to the one where you live. People in US states with privacy laws, and anywhere else, can ask for the same. Email privacy@githubworth.com and we'll reply within 30 days.
Changes
When this policy changes, the date at the top changes with it.