What we keep
What a report shows
A report is made from what GitHub shows anyone about a public repository, such as its commit history, files, pull requests, issues, tags, releases and stars. People appear only by GitHub login: the account a commit links to, or the account that opened a pull request. Commits GitHub can't link to an account show as unnamed contributors. Names and e-mail addresses from git are read while the report is made, then dropped: they're never stored or shown. Times are shown in UTC.
What we keep
The report page, its share image and the data it was drawn from, so the page can be drawn again. Report pages carry no analytics or tracking scripts.
When you make a report
We keep the repository's name and the time you asked. For rate limits and to stop abuse, we keep an HMAC (a keyed hash) of your IP address, never the address itself. We delete it after today and yesterday (UTC); Cloudflare's database keeps its restore history for up to 30 days, and then the hash is gone. Cloudflare Turnstile checks that a person sent the form; Cloudflare's privacy policy covers that check.
Removing a report
Every public repo report links to Remove this report. A person reviews each request and decides. If a report comes down, its repository joins our opt-out list, so no one can make a new report of it here. We keep the repository's name, when it was asked for and what was decided, and, as when you make a report, an HMAC of your IP address for today and yesterday. Cloudflare Turnstile checks this form too. A reason or an e-mail address you add with the first request for a report goes to Maff by e-mail and isn't stored here. While that request waits for his decision, later requests are only counted: their reasons and addresses are not kept. You can also write to stats@maff.app.