Privacy Policy

1. What Information Is Accessed

GitHub Time Machine accesses only the information necessary to construct and display your developer documentary:

• Public GitHub user profile details (username, display name, avatar, bio).
• Public repository metadata (repository names, descriptions, primary programming languages, creation dates).
• Public commit metadata (commit subject lines, timestamps, short SHA hashes, author names).
• For authenticated users, read-only access to your repository list and contribution calendars.

2. GitHub Authentication

When you sign in using GitHub, authentication is handled through an industry-standard OAuth flow via Supabase. Sensitive credentials, OAuth tokens, and server-side API keys are securely managed server-side and are never exposed to the client-side JavaScript or the browser extension.

3. Repository & Commit Data

The Service reads commit metadata to assemble the chronological chapters and milestones of your journey. The application does not download or duplicate your repository codebases. It strictly parses commit summaries, dates, and milestone events.

4. How Data Is Used

Accessed data is used exclusively to:

• Generate your interactive cinematic timeline replay.
• Derive documentary narrative titles and monthly focus summaries.
• Calculate aggregate metrics (streaks, commit counts, top languages, activity patterns).
• Enable client-side exports (such as rendering PDF developer summaries or MP4 videos in your browser).

5. Whether Data Is Stored

We do not store your repository code, proprietary diffs, or commit messages in any external persistent database.

During an active documentary session, fetched commit data is stored temporarily in your browser's sessionStorage. This eliminates redundant GitHub API calls while you scrub, pause, or rewind through chapters. Once you close your browser tab or window, this session cache is automatically cleared.

6. API Requests

Requests for public user history are routed directly to the GitHub REST API or through a lightweight serverless endpoint to apply caching headers and avoid rate limits. We do not sell, broker, or monetize your API queries.

7. Cookies & Local Storage

• Authentication: Supabase uses standard secure HTTP cookies to maintain your authenticated session.
• Preferences: The web application stores sound settings (audio enabled, volume) in browser localStorage so your soundtrack preferences persist between visits.
• Browser Extension: The GitHub Time Machine browser extension uses chrome.storage.local solely to store your custom Time Machine base URL override (if configured in extension settings).

8. Third-Party Services

The application relies on trusted infrastructure partners:

• GitHub, Inc.: Data source and OAuth provider.
• Supabase: Authentication management.
• Vercel: Static hosting and serverless API execution.

9. Data Retention

Temporary session data resides only in your local browser memory for the duration of your viewing session. When your session ends, the memory and cache are disposed of by your browser.

10. User Choices & Revocation

You retain complete control over your GitHub data. You may revoke the application's OAuth token at any time by visiting your GitHub account settings at:

GitHub → Settings → Applications → Authorized OAuth Apps → Revoke

11. Contact

For privacy inquiries or technical questions regarding data processing in GitHub Time Machine, please open an issue or inquiry on the official GitHub project repository.