# What Get Git Gone can access Last updated: 2026-10-15 Get Git Gone is an independent project, not affiliated with or endorsed by GitHub, Inc. GitHub and the Octocat are trademarks of GitHub, Inc. **In short:** when you sign in, the game asks GitHub for two permissions. It uses them to read your profile and public GitHub data, and to fork a public repository to your account when you press **Fork**. Apart from creating that fork, it never changes anything on your GitHub account. The permission GitHub calls `public_repo` would allow more than that; this page says exactly what. ## The permissions it asks for The game asks for `read:user` and `public_repo`, nothing else. You see this list on GitHub's approval page before you agree. ### `read:user` - **What GitHub says it allows:** "Grants access to read a user's profile data." - **What the game does with it:** when you sign in, it reads your profile once and keeps your login, display name, avatar URL and GitHub user id. Your login is how the game knows which building is yours. ### `public_repo` - **What GitHub says it allows:** "Limits access to public repositories. That includes read/write access to code, commit statuses, repository projects, collaborators, and deployment statuses for public repositories and organizations. Also required for starring public repositories." - **So, technically:** a token with this permission could change your public repositories, for example push code, add collaborators or star repositories. - **What the game does with it:** one thing that writes. When you press **Fork** (or **Fork + clone**) in a vault, the game asks GitHub to fork that public repository to your account. That is the only change it ever makes on GitHub. It never pushes code, edits or deletes anything, changes settings, adds collaborators or stars repositories. - It also makes your lookups with your own token (searching, opening a profile, entering a vault, reading files and READMEs), so they count against your own GitHub rate limit and not the game's. These only read public data. **Clone** doesn't use your GitHub token at all. It runs on your own computer through the game's small helper (`cli/getgit`), which clones the public repository with plain `git clone` from `https://github.com/`. ### What it can't reach - **Private repositories and private code.** The game doesn't ask for the `repo` permission, which is what private repositories need. If GitHub ever answers with something marked private, the game refuses it and doesn't keep it. - **Your email address.** The game doesn't ask for `user:email` and doesn't store an email address from GitHub. - **Your password.** You sign in on github.com; the game only ever receives a token from GitHub. ## What is stored On the game's server: - **Your sign-in session**, for up to 30 days: your login, name, avatar URL, GitHub user id, the permissions you granted, when you signed in, your GitHub token and a short fingerprint of it. The token is encrypted, never sent to your browser and never written to logs. Signing out deletes the session and the token at once. - **Your building:** the same public data every building in the city has (login, avatar URL, follower and repository counts, account creation date, primary language, star total, and your own public repositories with their names, stars, forks, languages, last push dates and the start of their descriptions). Up to 10 public accounts you follow may be added to the city as your neighbours. - **Your game progress, by GitHub login:** heist tokens, best scores, the decorations you bought, and your place on the city's leaderboard screen, where your login and score are public. In your browser: a sign-in cookie (`ggg_session`, 30 days), a short-lived one during sign-in (`ggg_oauth`, 10 minutes), and your settings and progress in local storage. No analytics or advertising cookies. The full technical list (every cookie, storage key, server record and how long it lasts) is the **Data inventory**, linked under the sign-in button. The **Privacy Policy** (the sign-in screen and the footer) covers the rest. ## Exploring without signing in You don't have to sign in to look around: "Explore the city" lets you fly the city as a guest. Nothing is asked of GitHub for a guest and no account, session or cookie is created; the permissions above only come into play when you press Sign in with GitHub. The Privacy Policy's section "Exploring without signing in" says what a guest's browser sends. ## Revoking access - **Sign out** in the game (Sign out on the title screen, or your avatar in the top bar, then Sign out): the session and your token are deleted from the server. - **Revoke the game on GitHub** at any time: go to , open **Authorized OAuth Apps**, choose Get Git Gone and press **Revoke**. The token stops working at once. The next time the game tries to use it, GitHub refuses, and the game deletes your session and signs you out. Revoking doesn't undo forks you already made: they are ordinary repositories on your account, and you can delete them on GitHub like any other. ## Leaving the city Your building stays in the city after you sign out or revoke access, like every other public profile. To have it removed, email **getgitgone@gmail.com** from the address on your GitHub profile (or include a link proving you control the account), say "remove my building" and give your GitHub login. Your login goes on the game's opt-out list: your building, its floors and your name leave the city, search, contracts, What's hot and the leaderboards, and the game won't add your profile again, even if someone searches for it or you sign in. We aim to act within 7 days. You can ask in the same email for your stored game progress to be deleted. ## Contact Questions about any of this: **getgitgone@gmail.com**.