Privacy

Last updated 2026-08-17 · changes when behavior changes, not to look fresh

GitHub Stats SVG renders public GitHub statistics as SVG images. This page describes exactly what the service stores, for how long, and how to remove it. There are no accounts, no cookies, no localStorage, no analytics, no ads, and no third-party scripts anywhere on this site.

What is processed when a card renders

• The GitHub username in the card URL. The service asks GitHub's API for that user's public statistics and draws them as an SVG.
• Cached results. The fetched statistics and the rendered SVG are cached in Redis so repeated views don't hit GitHub. Cache entries expire on their own: your chosen cache window (1–168 hours) plus at most 24 hours of stale-serving allowance.
• Your IP address, briefly. Used only as a rate-limit counter key in Redis, with windows of 60 seconds (rendering) or one hour (registration). The application deliberately writes no request logs.

What is stored when you register a card

• Your username and card settings (theme, card type, cache window), stored in Redis under a random identifier until you revoke.
• Optionally, a GitHub token you provide — sealed with envelope encryption (AES-256-GCM) the moment it arrives. The decryption key is derived from a server secret plus a secret share that exists only inside your card URL, so the server alone cannot decrypt it. The token is sent once over HTTPS and is never returned to any browser, including yours. Details are on the security page.
• A hash of your manage key. Only the SHA-256 hash is stored; the key itself is shown to you exactly once.

How to delete your data

Three controls, from narrowest to widest — all documented with copy-paste examples on the docs page:

• Revoke a card. Paste your manage key into the revoke form on the home page (or POST /api/revoke). The registration — including any encrypted token — is deleted immediately.
• Purge cached data. POST /api/purge with a username deletes every cached render and cached statistic this instance holds for it, right now, without waiting for expiry. Anyone can trigger it (it only clears cache), tightly rate-limited.
• Opt out entirely. POST /api/optout proves you own the account (any GitHub token of yours, zero scopes needed — used for one identity check and never stored) and then this instance stops rendering your username at all: no cards, no stats, no new registrations, until you opt back in.

Honest caveat: deletions are immediate at the origin, but copies already sitting in Vercel's CDN or GitHub's camo image proxy fade out on their own within the card's cache window (up to cacheHours). Cached renders also lapse that way on their own without any action.

Third parties involved

• GitHub — the source of the statistics, queried over its official API (GitHub privacy statement).
• Vercel — hosts the site and rendering function; as a hosting provider it keeps its own standard operational logs (Vercel privacy policy).
• Redis Cloud — stores the caches and registrations described above (Redis privacy policy).

No data is sold or shared with anyone else, and nothing is used for advertising or profiling.

Private contributions

If you opt into "count private contributions" with your own token, only aggregate counts (for example, your private commit total) are folded into the numbers. Repository names, code, and issue contents of private repositories are never stored or displayed; all listed data on every card is otherwise public-only by construction.

Questions

Open an issue on the GitHub repository. The service is maintained by George Khananaev.