The short version
WrapYourGit reads activity counts from GitHub to build your yearly recap. It never reads your code, stores only what the recap needs, shares nothing unless you publish it, and deletes everything when you ask.
What we collect
- Your GitHub identity: numeric account id, login, display name and avatar URL, so we know whose recap is whose.
- GitHub access tokens: issued when you sign in, encrypted at rest with AES-256-GCM and used only on our server. They are never sent to your browser.
- Your recap: counts computed from your GitHub activity for the year, such as contributions per day, languages, the repositories you committed to, pull requests, issues, reviews and stars. Private repositories appear as counts, and their names are kept out of anything shareable.
- Repository metadata, only if you choose: if you install WrapYourGit on your account or an organisation to count private repositories you own, it reads the metadata of the repositories you select (name, visibility, language, stars). Never their code. Private names still never appear in anything shareable.
- Your timezone: the one your browser reports when you sync, so the recap's dates and hours match your day.
- A session: we store a SHA-256 hash of your session token, never the token itself.
What we never collect
- Source code. Signing in asks GitHub for no repository permissions, and the optional installation asks for metadata only.
- Your email address, your followers or anything outside your year's activity.
- Analytics, advertising or tracking data. The site loads no third-party trackers.
How we use it
Only to build, show and export your recap: the story, the letter, the PNG and PDF slides, and the public page if you publish one. We do not sell or rent your data and do not use it to train models.
What goes public
Nothing, until you publish your recap from the dashboard. A published recap at /u/your-login shows a reduced copy:
- Private repository names and details are removed.
- Your timezone is replaced with UTC.
- The hours of the day you commit are withheld.
Unpublishing takes the page down immediately.
Who else is involved
GitHub, whose API we read your activity from under its own privacy statement. The service runs on cloud infrastructure; the hosting and database providers will be named here before the public launch.
How long we keep it
- Your recap and tokens: until you delete your data.
- Sessions: 30 days, or until you sign out.
- Server logs: error summaries only, without tokens or recap content.
Your choices
- Delete my data in Settings removes your account, recap, tokens and sessions, and revokes WrapYourGit's access to GitHub.
- You can also revoke access at any time on GitHub, under Settings, Applications.
- Unpublish your public recap from the dashboard whenever you like.
Changes
If what we collect or how we use it changes, this page changes first, with a new date at the top.