Privacy

GLYPH reads your GitHub profile and public activity statistics, turns them into a card, and stores that card. Your card is published at a public URL. We do not store your code, your repository names, or your GitHub access token. Your stats are sent to one third party — Anthropic's Claude API — once, to write the three lines of text on your card. We also use Vercel Analytics and PostHog to understand how the product is used.

This page describes what the software actually does today. Where something isn't built yet, it says so.

When you sign in, GitHub asks you to approve these scopes: read:user, user:email, and repo.

repo is broad — GitHub grants it as read and write access to your public and private repositories. GLYPH only ever reads, and only reads aggregate numbers: repository counts, star counts, primary languages, and your contribution calendar. It never reads file contents, commit messages, issues, or pull requests, and it never writes anything to your account.

Because that scope includes private repositories, your private repositories do count towards the totals on your card — the number of repos, the star count and the language mix. The names of those repositories are not stored, and nothing that identifies an individual repository ever appears on your card.

Two tables, and this is all of it.

Your account:

• Your GitHub numeric ID and username
• Your display name and avatar image URL
• The email address on your GitHub account
• Previous usernames, if you rename your GitHub account, so links people already shared keep working
• Your generated card: archetype, modifier, rarity, and the three-line description

Your statistics:

• Total contributions, current streak, and longest streak
• Total stars, total repositories, and follower count
• Language breakdown and top languages
• The date your GitHub account was created, and when we last synced

• Your GitHub access token — it is held only inside your encrypted session cookie and is never written to our database. Signing out discards it.
• Repository names, file contents, commit messages, diffs, or any source code.
• Anything about accounts other than your own.

Once you generate a card, it is published at glyph.so/your-username and anyone with the link can view it without signing in. That page shows your display name, avatar, GitHub username, archetype, rarity, description, and the four headline stats.

Your email address is never shown on it. There is currently no setting to make a card private — if you would rather it not be public, don't generate one.

Three third-party services receive data from GLYPH:

• Anthropic Claude API — your username, archetype, modifier, rarity, total commits, longest streak, total stars, total repositories, and top languages are sent once per card generation to write the description on your card. Your email address, avatar, and access token are not included.
• Vercel Analytics — page view and performance metrics. No cookies. No personally identifiable information. See vercel.com/legal/privacy-policy.
• PostHog — session recording and product analytics, used to understand where users get stuck. Hosted in the United States. No personally identifiable information beyond IP address and browser metadata. See posthog.com/privacy.

GitHub is where the data comes from, and our database is hosted on Supabase. We do not sell your data, and there is no advertising on this site.

Being straight with you: there is no self-serve delete button, and no automated way to request removal. That is a gap, not a policy.

What you can do today is revoke GLYPH's access from your GitHub authorised applications settings. That immediately stops GLYPH reading anything further from your account, but it does not by itself remove the card and statistics already stored, or unpublish your public page.

To have your stored data removed, open an issue on the GLYPH repository and it will be deleted manually. A proper deletion flow is planned.

One cookie, set by the sign-in system to keep you logged in and to hold your GitHub access token. There are no advertising or tracking cookies.

If what the software collects changes, this page changes with it, and the date at the top moves.