Privacy

Last updated 16 September 2026.

What we collect

From GitHub, at sign-in: your login, name, avatar and email. Your public activity is read through GitHub's public API; this requires no access to your repositories.
From GitHub, only if you install our app: GitHub grants us read access to the contents of the repositories you select, which is the only way GitHub offers to count lines in private repositories. For each push, merged pull request and release we store the repository name, commit SHA, link, line counts after exclusions, the time GitHub delivered it to us, and the reason it counted or not. File contents and diffs are read to count lines and are never stored.
From Strava: your athlete id and name, and for each activity only its id, start time, moving time, and the manual, flagged, device, trainer and sport-type fields needed to apply our rules, plus the reason it counted or not. Raw payloads are discarded after evaluation. We never store names, distance, pace, elevation, routes, maps, photos, kudos or streams.
From you: timezone, bio, settings, and any report you file.
Technical: server logs, and anonymous product analytics that never include Strava-derived fields beyond booleans.

What is public

Your profile, leaderboard row, badge and share images show only whether you shipped and moved on a given day, your streaks and Double Day counts, and the code proof (repository and commit) for public repositories. Private repository names are hidden unless you turn them on. No Strava activity detail is ever visible to anyone but you, on your own dashboard.

Retention and deletion

Disconnecting Strava, or revoking access on Strava, purges every Strava-derived row within the hour and recomputes your days without it.
Disconnecting GitHub repositories forgets the installation and every counted contribution.
Deleting your account removes your account and all derived data immediately; backups expire within 30 days.

AI

We do not use your GitHub or Strava data to train or prompt any AI system.

Processors

Hosting on Vercel, database on Neon, cache on Upstash, email on Resend, analytics on PostHog. Each processes data on our behalf under their own terms.

Contact

privacy@shipandsweat.com