Privacy Policy

Who we are

Gitfile is a product operated by Starhub SPA, a company registered in Chile (RUT 77.500.684-6), domiciled at Av. Manuel Antonio Matta 277, Santiago, Chile (phone +56 2 2459 2493). Starhub SPA is the data controller for the information described below.

Data we collect

From GitHub, when you sign in

• Signing in with "Continue with GitHub" shares your public profile: GitHub ID, username, display name, avatar URL, bio, and your public repository, follower, star, and language stats.
• If you opt in to including private repositories, that sends you through a separate GitHub consent screen requesting the additional repo scope. The resulting access token is encrypted at rest (AES-256-GCM), decrypted only server-side to fetch your stats, and never sent to your browser or logged in plaintext.
• If your organization has "OAuth App access restrictions" enabled and blocks Gitfile from seeing its repos, the Privacy tab offers a documented, narrow fallback: pasting a classic personal access token (PAT). That token is verified against your own account before it's encrypted and stored the same way as the OAuth token. Gitfile cannot revoke a pasted PAT: deleting it from Gitfile removes our copy, but the token stays valid on GitHub until you revoke it there. We recommend a token with the minimum scope and a short expiration.

From GitLab, when you sign in

• Signing in with "Continue with GitLab" (gitlab.com) requests only the read_user scope and shares your public profile: GitLab ID, username, display name, avatar URL, bio, and the public projects, stars, followers and contribution activity we use to build your banner.
• If you opt in to including private projects, a second GitLab consent screen requests the read_api scope, which GitLab defines as read-only access to the API. The token is encrypted and handled exactly like the GitHub one above.
• As on GitHub, you may paste a personal access token as a narrow fallback. The same limits apply: we can delete our copy, but only you can revoke the token on GitLab.

What you give us directly

• Your banner and profile-page configuration: which fields you choose to show, theme, layout, custom bio text, and pinned repos.
• If you generate a Gitfile API key, we store a SHA-256 hash of it — never the raw key, which is only ever shown once, at creation.
• The version of these documents you accepted and when. You confirm it with a checkbox before signing in, and we ask you again when the documents change materially. Until you accept, your account is read-only (changes to your configuration, tokens and API keys are rejected), though you can still delete it.

Automatically

• A signed, httpOnly session cookie (gitfile_session) that keeps you signed in for 30 days.
• Short-lived, httpOnly state cookies (gitfile_oauth_state, gitfile_gitlab_oauth_state) used only to protect the sign-in redirect against CSRF — deleted immediately after use.
• Structured request logs for debugging and abuse prevention: the endpoint name, HTTP method, query and path parameters, response status and duration, a request ID, and an opaque account or API-key ID when you are authenticated. Request bodies are logged with secrets (tokens, keys, passwords) masked, and response bodies are only logged when a request fails. Gitfile does not write your IP address or user agent to these logs, but our hosting provider (Vercel) processes network-level data such as your IP address to serve and protect the site.

We don't use analytics or advertising cookies. See the Cookie Policy for the full list.

What we never ask for

• We never ask for your GitHub or GitLab password.
• We never request a raw personal access token as the primary way to sign in — only OAuth, with the one narrow, documented fallback above for org-restricted repos.

People who don't use Gitfile

Anyone can open gitfile.dev/<username> or request a banner for a GitHub or GitLab username, even if that person has never signed in to Gitfile. In that case we show a preview built only from the data that provider already publishes through its public API (profile name, avatar, bio, public repositories or projects, stars, followers and languages). We do not create an account for them, and we do not read anything private.

• The fetched stats are cached for about 24 hours and then refreshed or discarded.
• Unclaimed profile pages are marked so that search engines are asked not to index them.
• Our lawful basis is legitimate interest: showing a preview of data the provider already makes public. You have the right to object, as described below. Requests for these previews are rate limited per IP address.
• If this is your username and you would rather not have a preview, use the exclusion form. The form only registers your request as pending; it does not exclude anything by itself. To confirm that you own the username, write to contacto@starhub.cl with the username and some proof of ownership, such as a temporary change to your profile on the provider or a message sent from the email address on that profile. We review each request manually and answer within 15 days.
• Once we approve a request, we stop fetching and caching that username's data and purge what we had, and its page and banner show as unavailable. We store only the provider, the normalized username, the status of the request (pending or approved) and its dates: no reason and no contact details. An exclusion only affects previews of accounts that have not been claimed on Gitfile: if the owner has a Gitfile account, their own profile settings apply instead. We reply the same way whether or not the username exists, so the form can't be used to find out who uses Gitfile.

How we use it

• Render your public banner and profile page from the configuration and provider stats you've chosen to show.
• Operate your dashboard and keep your configuration in sync.
• Detect and prevent abuse of the public banner endpoint and the API.
• Respond to you if you contact us.

We don't sell your data, and we don't use it to train any model.

Who we share it with

• GitHub, Inc. and GitLab Inc. — to authenticate you and read the data you've granted access to (and, for the public preview, public data), governed by their own privacy statements.
• Amazon Web Services (DynamoDB) — where your account record and configuration are stored.
• Vercel Inc. — hosting, CDN, build infrastructure and platform logs for gitfile.dev.

We don't share your data with any advertising network or data broker.

International transfers

Gitfile is operated from Chile, but the infrastructure providers above (AWS, Vercel) store and process your data in the United States. We have signed data processing agreements with both AWS and Vercel, which include standard contractual clauses for international transfers, and we only work with providers that maintain their own recognized security and compliance programs. You can ask us for details of the safeguards in use using the contact below.

How long we keep it

• Account and configuration data: until you delete your account (see "Your rights").
• Rendered banner cache: refreshed roughly every 24 hours, or invalidated immediately on a config change.
• Provider OAuth tokens and pasted tokens: deleted the moment you disconnect that provider or delete your account. A standard sign-in without the private opt-in never stores one to begin with.
• Request logs: kept by our hosting provider (Vercel) for up to 30 days, depending on our hosting plan. The code only writes them to standard output and does not delete them itself. Deleting your account does not remove past log entries, which can still contain your username.
• Exclusion requests (see "People who don't use Gitfile"): kept until you ask to be removed from the list, including after an account is deleted. Requests we reject are deleted.

Your rights

Under Chile's personal data protection law (Ley 19.628, as updated by Ley 21.719 once in force) you have the rights of access, rectification, erasure (supresión), objection (oposición), portability and blocking (bloqueo) of your personal data. In practice:

• See exactly what will be publicly visible before you ever copy your banner link, shown directly in the dashboard.
• Export your configuration through the API.
• Disconnect (Dashboard → Privacy): revokes our OAuth grant on the provider's side, deletes your stored OAuth and pasted tokens, clears your cached banner and signs you out. It does not delete your Gitfile account or public profile configuration.
• Delete account: removes your account, linked identities, username claims, configuration, API keys and cached data, and ends all sessions. Use Dashboard → Privacy → Danger zone and type your username to confirm. It takes effect immediately, with no grace period, and can't be undone. It does not delete request logs (see "How long we keep it"), it cannot revoke a personal access token you pasted (only our encrypted copy is deleted; revoke it on GitHub or GitLab), and a banner already cached on one of our servers may keep being served until its cache expires, about 24 hours at most.
• Request by email: write to contact@gitfile.dev to exercise any of the rights above. We answer within 15 days.
• Revoke any Gitfile API key instantly.

You may lodge a complaint with Chile's Agencia de Protección de Datos Personales (once operating) or the competent consumer or data authority. Gitfile is not aimed at users in the EEA, the UK or California; if you are there, you may still have rights under your local law (such as the GDPR or the CCPA), and we will handle your request the same way. Gitfile does not sell personal information. You can also reach our data protection contact, and send complaints, at contacto@starhub.cl.

Security

• OAuth tokens are encrypted at rest (AES-256-GCM) and only ever decrypted server-side.
• API keys are hashed (SHA-256), never stored or displayed in plaintext after creation.
• AWS access is scoped to a least-privilege IAM policy limited to our own DynamoDB table.
• Every API request is validated at the boundary before it touches our database or a provider's API.
• The site sends standard browser security headers (HSTS, content-type sniffing protection, a referrer policy, clickjacking protection and a permissions policy). A Content Security Policy is also being trialled in report-only mode.

No system is perfectly secure. If you believe you've found a vulnerability, please report it responsibly to the contact below rather than exploiting it.

Children

Gitfile is not directed at anyone under 16, and we don't knowingly collect data from them. If you believe a child has signed up, contact us and we'll delete the account.

Changes to this policy

We'll update the "Last updated" date above whenever this policy changes, and for material changes, we'll surface a notice in the dashboard and ask you to accept the new version.

Contact

General: contact@gitfile.dev. Privacy and rights requests: the same address. Data protection contact and complaints: contacto@starhub.cl. Starhub SPA, Av. Manuel Antonio Matta 277, Santiago, Chile.