# Privacy Policy **DRAFT - pending legal review** Last updated: 2026-10-15 Get Git Gone is an independent project, not affiliated with or endorsed by GitHub, Inc. GitHub and the Octocat are trademarks of GitHub, Inc. Get Git Gone ("the game") is made by Anuj Tirole, based in India. Contact: getgitgone@gmail.com. This page says what the game collects, why, how long it keeps it and who else receives it. It describes what the game's code actually does; the full technical list is in `docs/data-inventory.md` in the game's source. ## What the city is made of Every building in the city is a real, public GitHub profile, and every floor is one of that profile's public repositories. The city fills itself with about 800 popular public profiles (500 until October 15, 2026) and adds profiles that players search for (and a few accounts those profiles follow). Profiles that asked to be left out (see below) are never among them. For each building the game keeps public data from GitHub's API: the login, account type, avatar URL, follower and public repository counts, account creation date, primary language, star total, and the list of the profile's own repositories (name, stars, forks, last push date, language, whether it is a fork or archived, and the first 80 characters of its description). It is refreshed from GitHub and kept for as long as the building stands. ### Removing your building If your GitHub profile is in the city and you do not want it to be, email getgitgone@gmail.com from the address on your GitHub profile (or include a link proving you control the account) and say "remove my building", with your GitHub login. We add your login to the game's opt-out list: your building, its floors and your name disappear from the city, search, contracts, What's hot and the leaderboards, and the game will not add your profile again, even if someone searches for it or you sign in. We aim to act within 7 days. ## Exploring without signing in You can explore the city without signing in ("Explore the city" on the first screen): fly around, use the maps, look at buildings already in the city and their public cards, What's hot and the day's contracts board. Breaking into a building, heists, contracts, following and your own building need you to sign in. - **No account, no cookie, no session.** The game stores nothing that identifies a guest and sets no cookie. - **GitHub is never asked anything for a guest.** A guest only sees what the city already holds. Looking for a profile that isn't in the city yet asks you to sign in instead of looking it up. - **What your browser sends** is what the city needs to draw (the parts of the map around you, building and repo names, pictures already stored) and, if you search, the name you typed. - **To keep the game fair to everyone**, guest requests are counted per visitor for one minute under a keyed one-way code made from your IP address (never the address itself), then forgotten. - **Billboards:** a guest's view of an ad screen only adds one to the day's total; no code for the visit is kept. - **Likes:** a guest can like a building, which keeps the same 7-day code made from the IP address as described below for signed-out likes. ## Signing in with GitHub Signing in is optional for looking around (see above), but needed to play as yourself and to fork repositories. - The game asks GitHub for the scopes **`read:user`** (your public profile) and **`public_repo`** (needed to fork a repository to your account; GitHub's `public_repo` scope also allows writing to your public repositories — the game only ever creates forks). - Your GitHub access token is received by the game's server, **encrypted, and stored only on the server** for up to 30 days, inside your sign-in session. It is never sent to your browser and never written to logs. Signing out deletes the session. - The session keeps your GitHub login, display name, avatar URL, GitHub user id, the scopes you granted and when you signed in. - Your browser receives a cookie, `ggg_session` (an opaque random identifier; 30 days), and during sign-in a short-lived `ggg_oauth` cookie (10 minutes). Both are essential for sign-in; the game sets no analytics or advertising cookies. When you are signed in, lookups you make (searching, opening a profile, entering a vault, forking) are made with your own GitHub token and count against your own GitHub rate limit. ## Game progress and leaderboards - **On the server, by GitHub login:** your heist-token balance, best score per contract, the decorations you bought, your Hangar look, and your rank on the city's leaderboard screen (your GitHub login and score are shown publicly there). Kept until you ask us to delete them. - **Contract leaderboards:** the nickname you choose and your score and time are shown publicly for 3 days. The server keeps only a one-way hash of the random secret that owns your nickname (90 days from last use). To limit abuse, leaderboard posts are counted per visitor for up to one hour, under a keyed one-way code made from your IP address (never the address itself). - **Your Hangar look** (your helicopter's and thief's colours and styles, and a callsign of up to 12 letters, digits, spaces or hyphens): signed in, it is stored on the server under your GitHub login so it loads on any device, and is shown only to you (never on a leaderboard, a share card or another player's screen). As a guest it stays in your browser and is never sent to the server. - **In your browser (localStorage):** settings, tutorial and how-to progress, today's finished contracts, XP and cosmetics (a guest's Hangar look), your leaderboard nickname and its secret, recent searches, likes and follows you made, and whether you dismissed a tip. This stays on your device; clear your browser's site data to remove it. - **Likes and follows of profiles:** to count each visitor once, the server stores a keyed one-way code (a hash that can't be turned back into what it was made from) with the profile you liked or followed — never your cookie, your IP address or your GitHub id themselves. Signed in, the code is made from your GitHub account number and is kept for as long as the like or follow stands, so an account counts once. Signed out, it is made from your IP address and deleted after 7 days. Like totals are kept. - **Vault rooms:** while you are inside a vault, a random per-tab identifier and your position are shared with other players in the same vault and kept for at most one hour. - **Billboards:** to count ad impressions once per visit, a keyed one-way code made from a random per-visit identifier (or from your IP address if the page sends none) is stored for 2 days; impression and click totals (no identifiers) are kept for 90 days. ## Share links After a heist, or when you upgrade your building in the Building shop, the game can make a share link for you (`getgitgone.site/s/...`). Nothing is posted anywhere unless you share the link yourself. - **What the link holds:** your GitHub login, what happened (for example "First heist complete") and when, signed by the game's server so it can't be altered. It names no repository and nothing about anyone else. - **What the share page and its picture show:** your public GitHub login, that outcome, and your building as the city already shows it to everyone: its floors, followers and stars, from the public data the city already holds (no new call to GitHub). - **Nothing new is stored.** The game keeps no record of the links it makes or who opens them; the server only checks a link's signature when it is opened. To stop people opening too many at once, the server counts requests per visitor for a minute in its own memory, under a keyed one-way code made from the IP address (never the address itself), and forgets them. - **Opted-out profiles are excluded:** no link is made for a login on the opt-out list, and every link for such a login stops working (it answers "not found"). - When you post a link on a social site, that site fetches the page and its picture from the game to show a preview. ## Server logs The game's server logs each request: the address requested (which can include what you searched for) and the result. Your IP address is not written to these logs, and sign-in codes and tokens are removed from them. Logs are kept by the hosting provider for 30 days. ## Who else receives data - **GitHub** — the game calls GitHub's API, sign-in, avatar and file services, with the game's own token or, when you are signed in, yours. - **Google Fonts** — your browser loads the game's fonts from Google (fonts.googleapis.com, fonts.gstatic.com), which receives your IP address and browser details. - **README images** — when you open a repository's README in a vault, your browser loads the images it contains directly from wherever they are hosted (often raw.githubusercontent.com or badge services); those hosts receive your IP address. - **Hosting** — the game runs on Google Cloud (server), Vercel (website) and Google Cloud (Redis running on Google Kubernetes Engine) (database), which process requests and data on our behalf. - **Only if you click:** links to GitHub, X (Share on X opens X with a post you choose to send), and email. We do not sell personal data and do not use it for advertising profiles. ## Your choices and rights You can sign out at any time, clear your browser's site data, revoke the game's access in your GitHub settings (Settings → Applications → Authorized OAuth Apps), and ask for your building and stored game data to be removed or for a copy of it by emailing getgitgone@gmail.com. Depending on where you live you may have further rights under data protection law, including the right to complain to your local authority. ## Children The game is not directed at children under 13 (or the minimum age for a GitHub account where you live). ## Changes We will update this page when the game's handling of data changes, and change the date above.